CVE-2008-4654: Buffer Overflow

Published Oct 21, 2008

Updated

Stack-based buffer overflow in the parsemaster function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player 0.9.0 through 0.9.4 allows remote attackers to execute arbitrary code via a TiVo TY media file with a header containing a crafted size value.

Affected Software

5 affected components

Videolan VLC Media Player=0.9.4

Videolan VLC Media Player=0.9.1

Videolan VLC Media Player=0.9.2

Videolan VLC Media Player=0.9

Videolan VLC Media Player=0.9.3

Event History

Oct 21, 2008

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-4654?

CVE-2008-4654 is classified as a high severity vulnerability due to its potential to allow remote code execution.

How do I fix CVE-2008-4654?

To fix CVE-2008-4654, upgrade VLC Media Player to version 0.9.5 or later, which addresses this buffer overflow issue.

What versions of VLC Media Player are affected by CVE-2008-4654?

CVE-2008-4654 affects VLC Media Player versions 0.9.0 through 0.9.4.

What kind of attack is CVE-2008-4654 associated with?

CVE-2008-4654 is associated with remote attacks that exploit a stack-based buffer overflow through crafted TiVo TY media files.

Can CVE-2008-4654 lead to arbitrary code execution?

Yes, CVE-2008-4654 can lead to arbitrary code execution on vulnerable systems when manipulated TiVo TY media files are processed.