CVE-2008-0984

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 15%

from disclosure to weapon59 days

Published on NVDFeb 26

1st PoC+59d

exploitation probability

15%top 4% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/5498

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060481.html http://secunia.com/advisories/29122 http://secunia.com/advisories/29153 http://secunia.com/advisories/29284 http://secunia.com/advisories/29766 http://www.coresecurity.com/?action=item&id=2147 http://www.debian.org/security/2008/dsa-1543 http://www.gentoo.org/security/en/glsa/glsa-200803-13.xml http://www.securityfocus.com/archive/1/488841/100/0/threaded http://www.securityfocus.com/bid/28007 http://www.securitytracker.com/id?1019510 http://www.videolan.org/security/sa0802.html