CVE-2011-3623

Published: 26 December 2014

Multiple stack-based buffer overflows in VideoLAN VLC media player before 1.0.2 allow remote attackers to execute arbitrary code via (1) a crafted ASF file, related to the ASF_ObjectDumpDebug function in modules/demux/asf/libasf.c; (2) a crafted AVI file, related to the AVI_ChunkDumpDebug_level function in modules/demux/avi/libavi.c; or (3) a crafted MP4 file, related to the __MP4_BoxDumpStructure function in modules/demux/mp4/libmp4.c.

Notes

1.0.1 down to 0.5.0

Status

References

• http://www.videolan.org/security/sa0901.html
• http://seclists.org/oss-sec/2011/q4/59
• https://www.cve.org/CVERecord?id=CVE-2011-3623
• NVD
• Launchpad
• Debian

Bugs

• https://bugs.gentoo.org/show_bug.cgi?id=285370