Homepage

Out-of-Bounds The advisory has been revoked - it doesn't affect any version of package vlc  (opens in a new tab)

Threat Intelligence

EPSS
20.58% (97th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-VLC-606955
  • published19 Aug 2020
  • disclosed8 Apr 2009
Report a new vulnerability Found a mistake?

Introduced: 8 Apr 2009

CVE-2009-1274  (opens in a new tab)
CWE-119  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:unstable.

NVD Description

Note: Versions mentioned in the description apply only to the upstream vlc package and not the vlc package as distributed by Debian.

Integer overflow in the qt_error parse_trak_atom function in demuxers/demux_qt.c in xine-lib 1.1.16.2 and earlier allows remote attackers to execute arbitrary code via a Quicktime movie file with a large count value in an STTS atom, which triggers a heap-based buffer overflow.

References