p PatchFirst

CVE-2017-8311

CVE-2017-8311

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.

CVSS 7.8 · High · EPSS 8.8% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • vlc

    Versions
    • <2.2.5: Affected

    No fix published

  • vlc Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.2.5-1

    Update to 2.2.5-1

  • vlc Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.2.5-1

    Update to 2.2.5-1

  • vlc Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.2.5-1

    Update to 2.2.5-1

  • vlc Ubuntu:14.04:LTS

    Versions
    • 2.0.8-1
    • 2.1.1-1
    • 2.1.2-1
    • 2.1.2-2
    • 2.1.2-2build1
    • 2.1.2-2build2
    • 2.1.4-0ubuntu14.04.1
    • 2.1.6-0ubuntu14.04.1
    • 2.1.6-0ubuntu14.04.2
    Affected ranges
    • ECOSYSTEM: < 2.1.6-0ubuntu14.04.3

    Update to 2.1.6-0ubuntu14.04.3

  • vlc Ubuntu:16.04:LTS

    Versions
    • 2.2.1-3
    • 2.2.1-5
    • 2.2.2-1
    • 2.2.2-2
    • 2.2.2-3
    • 2.2.2-3build1
    • 2.2.2-4
    • 2.2.2-5
    • 2.2.2-5ubuntu0.16.04.1
    • 2.2.2-5ubuntu0.16.04.2
    Affected ranges
    • ECOSYSTEM: < 2.2.2-5ubuntu0.16.04.3

    Update to 2.2.2-5ubuntu0.16.04.3

Original sources

Check your server →