CVE-2008-4686

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 9.9%

from disclosure to weapon0 days

Published on NVDOct 22

1st PoCOct 21

exploitation probability

9.9%top 5% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Multiple integer overflows in ty.c in the TY demux plugin (aka the TiVo demuxer) in VideoLAN VLC media player, probably 0.9.4, might allow remote attackers to execute arbitrary code via a crafted .ty file, a different vulnerability than CVE-2008-4654.

Affected products

n/a · n/a

public PoCs found — 2✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/6825 exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/6798

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=d859e6b9537af2d7326276f70de25a840f554dc3 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14630 http://www.openwall.com/lists/oss-security/2008/10/19/2 http://www.openwall.com/lists/oss-security/2008/10/22/6 http://www.securityfocus.com/bid/31867