CVE-2008-4654

EPSS 57.5%

Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player 0.9.0 through 0.9.4 allows remote attackers to execute arbitrary code via a TiVo TY media file with a header containing a crafted size value.

Affected products

n/a · n/a

public PoCs found — 7

githubgithub.com/KernelErr/VLC-CVE-2008-4654-Exploit★ 2 githubgithub.com/rnnsz/CVE-2008-4654★ 0 githubgithub.com/bongbongco/CVE-2008-4654★ 0 githubgithub.com/Hexastrike/CVE-2008-4654★ 0 exploitdbwww.exploit-db.com/exploits/6825unverified exploitdbwww.exploit-db.com/exploits/6798unverified exploitdbwww.exploit-db.com/exploits/16629unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=502726 http://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=fde9e1cc1fe1ec9635169fa071e42b3aa6436033 http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=26d92b87bba99b5ea2e17b7eaa39c462d65e9133 http://secunia.com/advisories/32339 http://securityreason.com/securityalert/4460 https://exchange.xforce.ibmcloud.com/vulnerabilities/45960 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14803 http://www.openwall.com/lists/oss-security/2008/10/19/2 http://www.securityfocus.com/archive/1/497587/100/0/threaded http://www.securityfocus.com/bid/31813 http://www.trapkit.de/advisories/TKADV2008-010.txt http://www.videolan.org/security/sa0809.html