VideoLAN VLC Media Player 2.0.9

CPE Details

VideoLAN VLC Media Player 2.0.9
videolan
vlc_media_player
2.0.9
2013-10-15
13h13 +00:00
2013-10-15
13h16 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:videolan:vlc_media_player:2.0.9:*:*:*:*:*:*:*

Informations

Vendor

videolan

Product

vlc_media_player

Version

2.0.9

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2023-46814 2023-11-21 23h00 +00:00 A binary hijacking vulnerability exists within the VideoLAN VLC media player before 3.0.19 on Windows. The uninstaller attempts to execute code with elevated privileges out of a standard user writable location. Standard users may use this to gain arbitrary code execution as SYSTEM.
7.8
High
CVE-2023-47359 2023-11-06 23h00 +00:00 Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a Heap-Based Buffer Overflow in function GetPacket() and results in a memory corruption.
9.8
Critical
CVE-2023-47360 2023-11-06 23h00 +00:00 Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length.
7.5
High
CVE-2022-41325 2022-12-05 23h00 +00:00 An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.
7.8
High
CVE-2020-26664 2021-01-08 16h40 +00:00 A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.
7.8
High
CVE-2019-19721 2020-05-15 15h28 +00:00 An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.
7.8
High
CVE-2014-9625 2020-01-24 20h57 +00:00 The GetUpdateFile function in misc/update.c in the Updater in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted update status file, aka an "integer truncation" vulnerability.
7.8
High
CVE-2014-9626 2020-01-24 20h57 +00:00 Integer underflow in the MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a box size less than 7.
7.8
High
CVE-2014-9627 2020-01-24 20h57 +00:00 The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large box size.
7.8
High
CVE-2014-9628 2020-01-24 20h57 +00:00 The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to trigger an unintended zero-size malloc and conduct buffer overflow attacks, and consequently execute arbitrary code, via a box size of 7.
7.8
High
CVE-2014-9629 2020-01-24 20h57 +00:00 Integer overflow in the Encode function in modules/codec/schroedinger.c in VideoLAN VLC media player before 2.1.6 and 2.2.x before 2.2.1 allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted length value.
7.8
High
CVE-2014-9630 2020-01-24 20h57 +00:00 The rtp_packetize_xiph_config function in modules/stream_out/rtpfmt.c in VideoLAN VLC media player before 2.1.6 uses a stack-allocation approach with a size determined by arbitrary input data, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted length value.
7.8
High
CVE-2019-5460 2019-07-30 18h38 +00:00 Double Free in VLC versions <= 3.0.6 leads to a crash.
5.5
Medium
CVE-2019-5459 2019-07-30 18h24 +00:00 An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read.
7.1
High
CVE-2019-13962 2019-07-18 17h58 +00:00 lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
9.8
Critical
CVE-2019-13615 2019-07-16 14h06 +00:00 libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.
5.5
Medium
CVE-2019-13602 2019-07-14 19h00 +00:00 An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.
7.8
High
CVE-2019-5439 2019-06-13 13h38 +00:00 A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit.
6.5
Medium
CVE-2018-11529 2018-07-11 14h00 +00:00 VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.
8
High
CVE-2017-17670 2017-12-15 08h00 +00:00 In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules/demux/mp4/libmp4.c in the MP4 demux module leading to a invalid free, because the type of a box may be changed between a read operation and a free operation.
8.8
High
CVE-2017-9300 2017-05-29 17h00 +00:00 plugins\codec\libflac_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly have unspecified other impact via a crafted FLAC file.
7.8
High
CVE-2017-9301 2017-05-29 17h00 +00:00 plugins\audio_filter\libmpgatofixed32_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (invalid read and application crash) or possibly have unspecified other impact via a crafted file.
7.8
High
CVE-2017-8311 2017-05-23 19h00 +00:00 Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
7.8
High
CVE-2017-8312 2017-05-23 19h00 +00:00 Heap out-of-bound read in ParseJSS in VideoLAN VLC due to missing check of string length allows attackers to read heap uninitialized data via a crafted subtitles file.
5.5
Medium
CVE-2017-8313 2017-05-23 19h00 +00:00 Heap out-of-bound read in ParseJSS in VideoLAN VLC before 2.2.5 due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process via a crafted subtitles file.
5.5
Medium
CVE-2016-5108 2016-06-08 12h00 +00:00 Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.
9.8
Critical
CVE-2016-3941 2016-04-18 13h00 +00:00 Buffer overflow in the AStreamPeekStream function in input/stream.c in VideoLAN VLC media player before 2.2.0 allows remote attackers to cause a denial of service (crash) via a crafted wav file, related to "seek across EOF."
5.5
Medium
CVE-2015-5949 2015-08-25 15h00 +00:00 VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file, which triggers the freeing of arbitrary pointers.
6.8
CVE-2014-9743 2015-08-17 15h00 +00:00 Cross-site scripting (XSS) vulnerability in the httpd_HtmlError function in network/httpd.c in the web interface in VideoLAN VLC Media Player before 2.2.0 allows remote attackers to inject arbitrary web script or HTML via the path info.
4.3
CVE-2014-1684 2014-03-03 15h00 +00:00 The ASF_ReadObject_file_properties function in modules/demux/asf/libasf.c in the ASF Demuxer in VideoLAN VLC Media Player before 2.1.3 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a zero minimum and maximum data packet size in an ASF file.
4.3
CVE-2013-6934 2014-01-23 20h00 +00:00 The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a space character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6933.
7.5