CVE-2017-8311 Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file...
HighCVSS 7.8
EPSS 8.8%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/vlc(Debian:12) | < 2.2.5-1 | 2.2.5-1 |
| debian/vlc(Debian:13) | < 2.2.5-1 | 2.2.5-1 |
| debian/vlc(Debian:14) | < 2.2.5-1 | 2.2.5-1 |
| videolan vlc media player | <= 2.2.4 | No fix listed |
| videolan vlc | = <2.2.5 | No fix listed |
References
- Debian Security Tracker CVE-2017-8311 vendor-advisory
- git.videolan.org
- DSA-3899 vendor-advisory
- 98634 vdb-entry
- GLSA-201707-10 vendor-advisory
- 44514 exploit