CVE-2010-3124 Untrusted search path vulnerability in bin/winvlc.c in VLC Media Player 1.1.3 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks...
HighCVSS 9.3
EPSS 12.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Untrusted search path vulnerability in bin/winvlc.c in VLC Media Player 1.1.3 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wintab32.dll that is located in the same folder as a .mp3 file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| videolan vlc media player | <= 1.1.3 | No fix listed |
| videolan vlc media player | = 0.1.99b | No fix listed |
| videolan vlc media player | = 0.1.99e | No fix listed |
| videolan vlc media player | = 0.1.99f | No fix listed |
| videolan vlc media player | = 0.1.99g | No fix listed |
| videolan vlc media player | = 0.1.99h | No fix listed |
| videolan vlc media player | = 0.1.99i | No fix listed |
| videolan vlc media player | = 0.2.0 | No fix listed |
| videolan vlc media player | = 0.2.60 | No fix listed |
| videolan vlc media player | = 0.2.61 | No fix listed |
| videolan vlc media player | = 0.2.62 | No fix listed |
| videolan vlc media player | = 0.2.63 | No fix listed |
| videolan vlc media player | = 0.2.70 | No fix listed |
| videolan vlc media player | = 0.2.71 | No fix listed |
| videolan vlc media player | = 0.2.72 | No fix listed |
| videolan vlc media player | = 0.2.73 | No fix listed |
| videolan vlc media player | = 0.2.80 | No fix listed |
| videolan vlc media player | = 0.2.81 | No fix listed |
| videolan vlc media player | = 0.2.82 | No fix listed |
| videolan vlc media player | = 0.2.83 | No fix listed |
| videolan vlc media player | = 0.2.90 | No fix listed |
| videolan vlc media player | = 0.2.91 | No fix listed |
| videolan vlc media player | = 0.2.92 | No fix listed |
| videolan vlc media player | = 0.3.0 | No fix listed |
| videolan vlc media player | = 0.3.1 | No fix listed |
Show 40 more
| Product | Affected versions | Fixed in |
|---|---|---|
| videolan vlc media player | = 0.4.0 | No fix listed |
| videolan vlc media player | = 0.4.1 | No fix listed |
| videolan vlc media player | = 0.4.2 | No fix listed |
| videolan vlc media player | = 0.4.3 | No fix listed |
| videolan vlc media player | = 0.4.4 | No fix listed |
| videolan vlc media player | = 0.4.5 | No fix listed |
| videolan vlc media player | = 0.4.6 | No fix listed |
| videolan vlc media player | = 0.5.0 | No fix listed |
| videolan vlc media player | = 0.5.1 | No fix listed |
| videolan vlc media player | = 0.5.2 | No fix listed |
| videolan vlc media player | = 0.5.3 | No fix listed |
| videolan vlc media player | = 0.6.0 | No fix listed |
| videolan vlc media player | = 0.6.1 | No fix listed |
| videolan vlc media player | = 0.6.2 | No fix listed |
| videolan vlc media player | = 0.7.0 | No fix listed |
| videolan vlc media player | = 0.7.2 | No fix listed |
| videolan vlc media player | = 0.8.0 | No fix listed |
| videolan vlc media player | = 0.8.1 | No fix listed |
| videolan vlc media player | = 0.8.2 | No fix listed |
| videolan vlc media player | = 0.8.4 | No fix listed |
| videolan vlc media player | = 0.8.5 | No fix listed |
| videolan vlc media player | = 0.8.6 | No fix listed |
| videolan vlc media player | = 0.9.2 | No fix listed |
| videolan vlc media player | = 0.9.3 | No fix listed |
| videolan vlc media player | = 0.9.4 | No fix listed |
| videolan vlc media player | = 0.9.5 | No fix listed |
| videolan vlc media player | = 0.9.6 | No fix listed |
| videolan vlc media player | = 0.9.8a | No fix listed |
| videolan vlc media player | = 0.9.9 | No fix listed |
| videolan vlc media player | = 0.9.10 | No fix listed |
| videolan vlc media player | = 1.0.0 | No fix listed |
| videolan vlc media player | = 1.0.1 | No fix listed |
| videolan vlc media player | = 1.0.2 | No fix listed |
| videolan vlc media player | = 1.0.3 | No fix listed |
| videolan vlc media player | = 1.0.4 | No fix listed |
| videolan vlc media player | = 1.0.5 | No fix listed |
| videolan vlc media player | = 1.0.6 | No fix listed |
| videolan vlc media player | = 1.1.0 | No fix listed |
| videolan vlc media player | = 1.1.1 | No fix listed |
| videolan vlc media player | = 1.1.2 | No fix listed |
References
- git.videolan.org
- 41107 third-party-advisory vendor-advisory
- 14750 exploit
- [oss-security] 20100825 Re: CVE request: VLC media player - DLL preloading vulnerability mailing-list
- [oss-security] 20100825 CVE request: VLC media player - DLL preloading vulnerability mailing-list patch
- ADV-2010-2172 vdb-entry vendor-advisory
- oval:org.mitre.oval:def:12190 signature vdb-entry
- Debian Security Tracker CVE-2010-3124 vendor-advisory