Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) command parameter to requests/vlm_cmd.xml, (2) dir parameter to requests/browse.xml, or (3) URI in a request, which is returned in an error message through share/lua/intf/http.lua.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade vlc | Jul 30, 2024 | Jan 31, 2020 |
| Suse | — | Upgrade libvlccore7Upgrade vlc-qtUpgrade vlc-noxUpgrade vlc-gnomeUpgrade vlc-noX-langUpgrade vlcUpgrade libvlc5Upgrade vlc-devel | Mar 5, 2014 | Mar 5, 2014 |
| Ubuntu | — | Upgrade vlc | Nov 19, 2024 | Jan 31, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub