CVE-2014-9625 in VLC Media Player
要約 (英語)
The GetUpdateFile function in misc/update.c in the Updater in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted update status file, aka an "integer truncation" vulnerability.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
予約する
2015年01月20日
ステータス
確認済み
エントリ
VulDB provides additional information and datapoints for this CVE:
| 識別子 | 脆弱性 | CWE | 悪用可 | 対策 | CVE |
|---|---|---|---|---|---|
| 68982 | VideoLAN VLC Media Player Updater メモリ破損 | 119 | 未実証 | 公式な修正 | CVE-2014-9625 |