CVE-2008-3794

Publication date 26 August 2008

Last updated 24 July 2024

Ubuntu priority

Description

Integer signedness error in the mms_ReceiveCommand function in modules/access/mms/mmstu.c in VLC Media Player 0.8.6i allows remote attackers to execute arbitrary code via a crafted mmst link with a negative size value, which bypasses a size check and triggers an integer overflow followed by a heap-based buffer overflow.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
vlc	9.10 karmic	Not affected
	9.04 jaunty	Not affected
	8.10 intrepid	Not affected
	8.04 LTS hardy	Fixed 0.8.6.release.e+x264svn20071224+faad2.6.1-0ubuntu3.2
	7.10 gutsy	Ignored end of life, was needed
	7.04 feisty	Ignored end of life, was needed
	6.06 LTS dapper	Ignored end of life

Notes

mdeslaur

PoC: http://www.milw0rm.com/exploits/6293

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
vlc	Upstream: http://git.videolan.org/?p=vlc.git;a=commit;h=afe3464a1c7c6f9d7640a3f5db17010c34212440

References

Other references

https://www.cve.org/CVERecord?id=CVE-2008-3794