CVE-2012-0023 Double free vulnerability in the get_chunk_header function in modules/demux/ty.c in VideoLAN VLC media player 0.9.0 through 1.1.12 allows remote attackers to cause a denial of service (crash) and poss...
HighCVSS 9.3
EPSS 4.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Double free vulnerability in the get_chunk_header function in modules/demux/ty.c in VideoLAN VLC media player 0.9.0 through 1.1.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TiVo (TY) file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/vlc(Debian:12) | < 1.1.13-1 | 1.1.13-1 |
| debian/vlc(Debian:13) | < 1.1.13-1 | 1.1.13-1 |
| debian/vlc(Debian:14) | < 1.1.13-1 | 1.1.13-1 |
| videolan vlc media player | = 0.9.0 | No fix listed |
| videolan vlc media player | = 0.9.1 | No fix listed |
| videolan vlc media player | = 0.9.2 | No fix listed |
| videolan vlc media player | = 0.9.3 | No fix listed |
| videolan vlc media player | = 0.9.4 | No fix listed |
| videolan vlc media player | = 0.9.5 | No fix listed |
| videolan vlc media player | = 0.9.6 | No fix listed |
| videolan vlc media player | = 0.9.8a | No fix listed |
| videolan vlc media player | = 0.9.9 | No fix listed |
| videolan vlc media player | = 0.9.9a | No fix listed |
| videolan vlc media player | = 0.9.10 | No fix listed |
| videolan vlc media player | = 1.0.0 | No fix listed |
| videolan vlc media player | = 1.0.1 | No fix listed |
| videolan vlc media player | = 1.0.2 | No fix listed |
| videolan vlc media player | = 1.0.3 | No fix listed |
| videolan vlc media player | = 1.0.4 | No fix listed |
| videolan vlc media player | = 1.0.5 | No fix listed |
| videolan vlc media player | = 1.0.6 | No fix listed |
| videolan vlc media player | = 1.1.0 | No fix listed |
| videolan vlc media player | = 1.1.1 | No fix listed |
| videolan vlc media player | = 1.1.2 | No fix listed |
| videolan vlc media player | = 1.1.3 | No fix listed |
Show 12 more
| Product | Affected versions | Fixed in |
|---|---|---|
| videolan vlc media player | = 1.1.4 | No fix listed |
| videolan vlc media player | = 1.1.4.1 | No fix listed |
| videolan vlc media player | = 1.1.5 | No fix listed |
| videolan vlc media player | = 1.1.6 | No fix listed |
| videolan vlc media player | = 1.1.6.1 | No fix listed |
| videolan vlc media player | = 1.1.7 | No fix listed |
| videolan vlc media player | = 1.1.8 | No fix listed |
| videolan vlc media player | = 1.1.9 | No fix listed |
| videolan vlc media player | = 1.1.10 | No fix listed |
| videolan vlc media player | = 1.1.10.1 | No fix listed |
| videolan vlc media player | = 1.1.11 | No fix listed |
| videolan vlc media player | = 1.1.12 | No fix listed |
References
- Debian Security Tracker CVE-2012-0023 vendor-advisory
- git.videolan.org
- 47325 third-party-advisory vendor-advisory
- 1026449 vdb-entry
- [oss-security] 20121029 VideoLAN TiVo Demuxer Duplicate CVEs (CVE-2011-5231 and CVE-2012-0023) mailing-list
- [oss-security] 20121030 RE: VideoLAN TiVo Demuxer Duplicate CVEs (CVE-2011-5231 and CVE-2012-0023) mailing-list
- 77975 vdb-entry
- 51231 vdb-entry
- www.videolan.org patch vendor-advisory
- vlcmediaplayer-getchunkheader-code-exec(71916) vdb-entry
- oval:org.mitre.oval:def:15893 signature vdb-entry