CVE-2016-5108 Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arb...
CriticalCVSS 9.8
EPSS 24.7%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/vlc(Debian:12) | < 2.2.3-2 | 2.2.3-2 |
| debian/vlc(Debian:13) | < 2.2.3-2 | 2.2.3-2 |
| debian/vlc(Debian:14) | < 2.2.3-2 | 2.2.3-2 |
| debian linux | = 8.0 | No fix listed |
| videolan vlc media player | <= 2.2.3 | No fix listed |
References
- Debian Security Tracker CVE-2016-5108 vendor-advisory
- openSUSE-SU-2016:1651 vendor-advisory
- DSA-3598 vendor-advisory
- 90924 vdb-entry
- 1036009 vdb-entry
- www.videolan.org vendor-advisory
- GLSA-201701-39 vendor-advisory
- bugs.debian.org issue-tracking