CVE-2014-9625

Katalog CVE

CVSS 7.8 · High EPSS 2,4%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada videolan vlc media player. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

The GetUpdateFile function in misc/update.c in the Updater in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted update status file, aka an "integer truncation" vulnerability.

Rincian

Terbit di NVD

24 Januari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

2,4% peluang dieksploitasi; lebih tinggi dari 83,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.videolan.org/security/sa1501.html advisory vendor
• https://github.com/videolan/vlc/commit/fbe2837bc80f155c001781041a54c58b5524fc14 patch · advisory pihak ketiga
• http://openwall.com/lists/oss-security/2015/01/20/5 mailing list · advisory pihak ketiga