CVE-2008-1881

EPSS 11.8%

Stack-based buffer overflow in the ParseSSA function (modules/demux/subtitle.c) in VLC 0.8.6e allows remote attackers to execute arbitrary code via a long subtitle in an SSA file. NOTE: this issue is due to an incomplete fix for CVE-2007-6681.

Affected products

n/a · n/a

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/5667unverified cve_referencewww.exploit-db.com/exploits/5250unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://aluigi.altervista.org/adv/vlcboffs-adv.txt http://aluigi.org/adv/vlcboffs-adv.txt http://secunia.com/advisories/28233 http://secunia.com/advisories/29800 http://security.gentoo.org/glsa/glsa-200804-25.xml https://exchange.xforce.ibmcloud.com/vulnerabilities/41237 https://exchange.xforce.ibmcloud.com/vulnerabilities/41936 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14872 https://www.exploit-db.com/exploits/5250 http://wiki.videolan.org/Changelog/0.8.6f http://www.securityfocus.com/archive/1/489698 http://www.securityfocus.com/bid/28251