p PatchFirst

CVE-2011-0522

CVE-2011-0522

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The StripTags function in (1) the USF decoder (modules/codec/subtitles/subsdec.c) and (2) the Text decoder (modules/codec/subtitles/subsusf.c) in VideoLAN VLC Media Player 1.1 before 1.1.6-rc allows remote attackers to execute arbitrary code via a subtitle with an opening "<" without a closing ">" in an MKV file, which triggers heap memory corruption, as demonstrated using refined-australia-blu720p-sample.mkv.

EPSS 51.5% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • vlc Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.1.3-1squeeze2

    Update to 1.1.3-1squeeze2

  • vlc Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.1.3-1squeeze2

    Update to 1.1.3-1squeeze2

  • vlc Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.1.3-1squeeze2

    Update to 1.1.3-1squeeze2

Original sources

Check your server →