CVE-2008-5036 Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an invalid RealText (rt) subtitle file, related to the....
HighCVSS 9.3
EPSS 41.4%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an invalid RealText (rt) subtitle file, related to the ParseRealText function in modules/demux/subtitle.c. NOTE: this issue was SPLIT from CVE-2008-5032 on 20081110.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| videolan vlc media player | = 0.9 | No fix listed |
| videolan vlc media player | = 0.9.0 | No fix listed |
| videolan vlc media player | = 0.9.1 | No fix listed |
| videolan vlc media player | = 0.9.2 | No fix listed |
| videolan vlc media player | = 0.9.3 | No fix listed |
| videolan vlc media player | = 0.9.4 | No fix listed |
| videolan vlc media player | = 0.9.5 | No fix listed |
| debian/vlc(Debian:12) | < 1.0.3-1 | 1.0.3-1 |
| debian/vlc(Debian:13) | < 1.0.3-1 | 1.0.3-1 |
| debian/vlc(Debian:14) | < 1.0.3-1 | 1.0.3-1 |
References
- Debian Security Tracker CVE-2008-5036 vendor-advisory
- git.videolan.org
- 32569 third-party-advisory
- 33315 third-party-advisory
- GLSA-200812-24 vendor-advisory
- [oss-security] 20081105 VideoLAN security advisory 0810 mailing-list
- [oss-security] 20081105 CVE id request: vlc mailing-list
- [oss-security] 20081110 Re: CVE id request: vlc mailing-list
- 20081106 [TKADV2008-011] VLC media player RealText Processing Stack Overflow Vulnerability mailing-list
- 32125 vdb-entry
- www.trapkit.de exploit
- www.videolan.org
- vlcmediaplayer-realtext-bo(46376) vdb-entry
- oval:org.mitre.oval:def:14329 signature vdb-entry
- 7051 exploit