CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Videolan » Vlc Media Player » * * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:a:videolan:vlc_media_player:*:*:*:*:*:*:*:*
CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2020-26664 787 Overflow 2021-01-08 2021-02-19
6.8
 None Remote Medium Not required Partial Partial Partial
A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.
2 CVE-2020-13428 787 DoS Exec Code Overflow 2020-06-08 2020-06-19
6.8
 None Remote Medium Not required Partial Partial Partial
A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.
3 CVE-2019-19721 193 DoS Mem. Corr. 2020-05-15 2021-07-21
6.8
 None Remote Medium Not required Partial Partial Partial
An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.
4 CVE-2019-13962 125 2019-07-18 2022-04-18
7.5
 None Remote Low Not required Partial Partial Partial
lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
5 CVE-2019-13615 125 2019-07-16 2020-08-24
4.3
 None Remote Medium Not required None None Partial
libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.
6 CVE-2019-13602 787 DoS Overflow 2019-07-14 2022-04-18
6.8
 None Remote Medium Not required Partial Partial Partial
An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.
7 CVE-2019-12874 415 2019-06-18 2019-06-25
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while parsing a malformed MKV file type, has a double free.
8 CVE-2019-5460 415 2019-07-30 2019-08-08
4.3
 None Remote Medium Not required None None Partial
Double Free in VLC versions <= 3.0.6 leads to a crash.
9 CVE-2019-5459 191 2019-07-30 2021-11-03
5.8
 None Remote Medium Not required Partial None Partial
An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read.
10 CVE-2019-5439 119 Exec Code Overflow 2019-06-13 2019-06-17
4.3
 None Remote Medium Not required None None Partial
A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit.
11 CVE-2018-11529 416 DoS Exec Code 2018-07-11 2019-03-21
6.8
 None Remote Medium Not required Partial Partial Partial
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.
12 CVE-2017-17670 416 2017-12-15 2019-04-26
6.8
 None Remote Medium Not required Partial Partial Partial
In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules/demux/mp4/libmp4.c in the MP4 demux module leading to a invalid free, because the type of a box may be changed between a read operation and a free operation.
13 CVE-2017-9301 125 DoS 2017-05-29 2017-06-06
6.8
 None Remote Medium Not required Partial Partial Partial
plugins\audio_filter\libmpgatofixed32_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (invalid read and application crash) or possibly have unspecified other impact via a crafted file.
14 CVE-2017-9300 119 DoS Overflow 2017-05-29 2017-11-23
6.8
 None Remote Medium Not required Partial Partial Partial
plugins\codec\libflac_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly have unspecified other impact via a crafted FLAC file.
15 CVE-2017-8313 125 2017-05-23 2017-11-04
4.3
 None Remote Medium Not required None None Partial
Heap out-of-bound read in ParseJSS in VideoLAN VLC before 2.2.5 due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process via a crafted subtitles file.
16 CVE-2017-8312 125 2017-05-23 2018-10-17
4.3
 None Remote Medium Not required Partial None None
Heap out-of-bound read in ParseJSS in VideoLAN VLC due to missing check of string length allows attackers to read heap uninitialized data via a crafted subtitles file.
17 CVE-2017-8311 119 Exec Code Overflow 2017-05-23 2018-04-27
6.8
 None Remote Medium Not required Partial Partial Partial
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
18 CVE-2016-5108 119 DoS Exec Code Overflow 2016-06-08 2017-07-01
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.
19 CVE-2016-3941 119 DoS Overflow 2016-04-18 2016-11-30
4.3
 None Remote Medium Not required None None Partial
Buffer overflow in the AStreamPeekStream function in input/stream.c in VideoLAN VLC media player before 2.2.0 allows remote attackers to cause a denial of service (crash) via a crafted wav file, related to "seek across EOF."
20 CVE-2015-5949 119 DoS Exec Code Overflow 2015-08-25 2018-10-09
6.8
 None Remote Medium Not required Partial Partial Partial
VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file, which triggers the freeing of arbitrary pointers.
21 CVE-2014-9743 79 XSS 2015-08-17 2015-08-19
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the httpd_HtmlError function in network/httpd.c in the web interface in VideoLAN VLC Media Player before 2.2.0 allows remote attackers to inject arbitrary web script or HTML via the path info.
22 CVE-2014-9630 119 DoS Overflow Mem. Corr. 2020-01-24 2020-01-29
6.8
 None Remote Medium Not required Partial Partial Partial
The rtp_packetize_xiph_config function in modules/stream_out/rtpfmt.c in VideoLAN VLC media player before 2.1.6 uses a stack-allocation approach with a size determined by arbitrary input data, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted length value.
23 CVE-2014-9629 120 Exec Code Overflow 2020-01-24 2020-01-29
6.8
 None Remote Medium Not required Partial Partial Partial
Integer overflow in the Encode function in modules/codec/schroedinger.c in VideoLAN VLC media player before 2.1.6 and 2.2.x before 2.2.1 allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted length value.
24 CVE-2014-9628 120 Exec Code Overflow 2020-01-24 2020-01-29
6.8
 None Remote Medium Not required Partial Partial Partial
The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to trigger an unintended zero-size malloc and conduct buffer overflow attacks, and consequently execute arbitrary code, via a box size of 7.
25 CVE-2014-9627 704 DoS 2020-01-24 2020-01-29
6.8
 None Remote Medium Not required Partial Partial Partial
The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large box size.
26 CVE-2014-9626 191 DoS 2020-01-24 2020-01-29
6.8
 None Remote Medium Not required Partial Partial Partial
Integer underflow in the MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a box size less than 7.
27 CVE-2014-9625 120 Exec Code Overflow 2020-01-24 2020-01-29
6.8
 None Remote Medium Not required Partial Partial Partial
The GetUpdateFile function in misc/update.c in the Updater in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted update status file, aka an "integer truncation" vulnerability.
28 CVE-2014-1684 189 DoS 2014-03-03 2017-07-01
4.3
 None Remote Medium Not required None None Partial
The ASF_ReadObject_file_properties function in modules/demux/asf/libasf.c in the ASF Demuxer in VideoLAN VLC Media Player before 2.1.3 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a zero minimum and maximum data packet size in an ASF file.
29 CVE-2013-7340 399 DoS 2014-03-21 2014-03-24
4.3
 None Remote Medium Not required None None Partial
VideoLAN VLC Media Player before 2.0.7 allows remote attackers to cause a denial of service (memory consumption) via a crafted playlist file.
30 CVE-2013-6934 189 DoS Exec Code Overflow 2014-01-23 2019-09-12
7.5
 None Remote Low Not required Partial Partial Partial
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a space character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6933.
31 CVE-2013-6283 20 1 DoS Exec Code 2013-10-25 2017-09-19
7.5
 None Remote Low Not required Partial Partial Partial
VideoLAN VLC Media Player 2.0.8 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a URL in a m3u file.
32 CVE-2013-4388 119 DoS Exec Code Overflow 2013-10-11 2017-09-19
6.8
 None Remote Medium Not required Partial Partial Partial
Buffer overflow in the mp4a packetizer (modules/packetizer/mpeg4audio.c) in VideoLAN VLC Media Player before 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
33 CVE-2013-3565 79 XSS 2020-01-31 2020-02-03
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) command parameter to requests/vlm_cmd.xml, (2) dir parameter to requests/browse.xml, or (3) URI in a request, which is returned in an error message through share/lua/intf/http.lua.
34 CVE-2013-3564 200 +Info 2020-02-06 2020-02-12
5.0
 None Remote Low Not required Partial None None
The web interface in VideoLAN VLC media player before 2.0.7 has no access control which allows remote attackers to view directory listings via the 'dir' command or issue other commands without authenticating.
35 CVE-2013-1954 119 DoS Exec Code Overflow 2013-07-10 2017-09-19
6.8
 None Remote Medium Not required Partial Partial Partial
The ASF Demuxer (modules/demux/asf/asf.c) in VideoLAN VLC media player 2.0.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ASF movie that triggers an out-of-bounds read.
36 CVE-2013-1868 119 DoS Exec Code Overflow 2013-07-10 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code via vectors related to the (1) freetype renderer and (2) HTML subtitle parser.
37 CVE-2012-5855 189 DoS 2013-07-10 2017-09-19
4.3
 None Remote Medium Not required None None Partial
The SHAddToRecentDocs function in VideoLAN VLC media player 2.0.4 and earlier might allow user-assisted attackers to cause a denial of service (crash) via a crafted file name that triggers an incorrect string-length calculation when the file is added to VLC. NOTE: it is not clear whether this issue crosses privilege boundaries or whether it can be exploited without user interaction.
38 CVE-2012-3377 119 DoS Exec Code Overflow 2012-07-12 2017-09-19
6.8
 None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in the Ogg_DecodePacket function in the OGG demuxer (modules/demux/ogg.c) in VideoLAN VLC media player before 2.0.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted OGG file.
39 CVE-2012-1776 119 DoS Exec Code Overflow 2012-03-19 2018-01-06
9.3
 None Remote Medium Not required Complete Complete Complete
Multiple heap-based buffer overflows in VideoLAN VLC media player before 2.0.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Real RTSP stream.
40 CVE-2012-1775 119 1 Exec Code Overflow 2012-03-19 2017-12-14
9.3
 None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote attackers to execute arbitrary code via a crafted MMS:// stream.
41 CVE-2011-3623 119 Exec Code Overflow 2014-12-26 2014-12-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple stack-based buffer overflows in VideoLAN VLC media player before 1.0.2 allow remote attackers to execute arbitrary code via (1) a crafted ASF file, related to the ASF_ObjectDumpDebug function in modules/demux/asf/libasf.c; (2) a crafted AVI file, related to the AVI_ChunkDumpDebug_level function in modules/demux/avi/libavi.c; or (3) a crafted MP4 file, related to the __MP4_BoxDumpStructure function in modules/demux/mp4/libmp4.c.
42 CVE-2011-2588 119 DoS Exec Code Overflow 2011-07-27 2017-09-19
6.8
 None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in the AVI_ChunkRead_strf function in libavi.c in the AVI demuxer in VideoLAN VLC media player before 1.1.11 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted AVI media file.
43 CVE-2011-0531 20 DoS Exec Code Mem. Corr. 2011-02-07 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
demux/mkv/mkv.hpp in the MKV demuxer plugin in VideoLAN VLC media player 1.1.6.1 and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary commands via a crafted MKV (WebM or Matroska) file that triggers memory corruption, related to "class mismatching" and the MKV_IS_ID macro.
44 CVE-2011-0021 119 DoS Exec Code Overflow 2011-01-25 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Multiple heap-based buffer overflows in cdg.c in the CDG decoder in VideoLAN VLC Media Player before 1.1.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted CDG video.
45 CVE-2010-3907 189 DoS Exec Code Overflow 2011-01-03 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Multiple integer overflows in real.c in the Real demuxer plugin in VideoLAN VLC Media Player before 1.1.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a zero i_subpackets value in a Real Media file, leading to a heap-based buffer overflow.
46 CVE-2010-3276 119 Exec Code Overflow 2011-03-28 2018-10-10
9.3
 None Remote Medium Not required Complete Complete Complete
libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an NSV file.
47 CVE-2010-3275 119 2 Exec Code Overflow 2011-03-28 2018-10-10
9.3
 None Remote Medium Not required Complete Complete Complete
libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an AMV file, related to a "dangling pointer vulnerability."
48 CVE-2010-3124 1 Exec Code 2010-08-26 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Untrusted search path vulnerability in bin/winvlc.c in VLC Media Player 1.1.3 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wintab32.dll that is located in the same folder as a .mp3 file.
49 CVE-2010-2062 189 Exec Code 2014-12-26 2014-12-29
7.5
 None Remote Low Not required Partial Partial Partial
Integer underflow in the real_get_rdt_chunk function in real.c, as used in modules/access/rtsp/real.c in VideoLAN VLC media player before 1.0.1 and stream/realrtsp/real.c in MPlayer before r29447, allows remote attackers to execute arbitrary code via a crafted length value in an RDT chunk header.
50 CVE-2010-1445 119 DoS Exec Code Overflow 2014-12-26 2014-12-29
7.5
 None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream in an RTMP session.
Total number of vulnerabilities : 58   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.