The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The GetUpdateFile function in misc/update.c in the Updater in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted update status file, aka an "integer truncation" vulnerability.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade vlc | Aug 30, 2017 | Feb 2, 2015 |
| Gentoo Linux | — | Upgrade media-video/vlc. | Oct 30, 2017 | Mar 12, 2016 |
| Suse | — | Upgrade vlc-qtUpgrade libvlccore7-debuginfoUpgrade vlc-noX-langUpgrade vlc-gnome-debuginfoUpgrade vlc-noxUpgrade vlc-noX-debuginfoUpgrade libvlc5Upgrade vlc-develUpgrade vlcUpgrade vlc-gnomeUpgrade live555-develUpgrade vlc-debugsourceUpgrade libvlc5-debuginfoUpgrade vlc-qt-debuginfoUpgrade vlc-debuginfoUpgrade libvlccore7 | Dec 18, 2015 | Feb 3, 2015 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub