CVE-2008-5032: Buffer Overflow

Published Nov 10, 2008

Updated

Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assisted attackers to execute arbitrary code via the header of an invalid CUE image file, related to modules/access/vcd/cdrom.c. NOTE: this identifier originally included an issue related to RealText, but that issue has been assigned a separate identifier, CVE-2008-5036.

Affected Software

36 affected components

Videolan VLC Media Player=0.5.0

Videolan VLC Media Player=0.5.3

Videolan VLC Media Player=0.6.0

Videolan VLC Media Player=0.6.2

Videolan VLC Media Player=0.7.0

Videolan VLC Media Player=0.7.1

Videolan VLC Media Player=0.7.1a

Videolan VLC Media Player=0.7.2

Videolan VLC Media Player=0.7.2-test2

Videolan VLC Media Player=0.7.2-test3

Videolan VLC Media Player=0.8.0

Videolan VLC Media Player=0.8.1

Videolan VLC Media Player=0.8.2

Videolan VLC Media Player=0.8.4

Videolan VLC Media Player=0.8.4-test2

Videolan VLC Media Player=0.8.4a

Videolan VLC Media Player=0.8.5

Videolan VLC Media Player=0.8.5-test3

Videolan VLC Media Player=0.8.5-test4

Videolan VLC Media Player=0.8.6

Videolan VLC Media Player=0.8.6a

Videolan VLC Media Player=0.8.6b

Videolan VLC Media Player=0.8.6c

Videolan VLC Media Player=0.8.6d

Videolan VLC Media Player=0.8.6e

Videolan VLC Media Player=0.8.6f

Videolan VLC Media Player=0.8.6g

Videolan VLC Media Player=0.8.6h

Videolan VLC Media Player=0.8.6i

Videolan VLC Media Player=0.9

Videolan VLC Media Player=0.9.0

Videolan VLC Media Player=0.9.1

Videolan VLC Media Player=0.9.2

Videolan VLC Media Player=0.9.3

Videolan VLC Media Player=0.9.4

Videolan VLC Media Player=0.9.5

Event History

Nov 10, 2008

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-5032?

CVE-2008-5032 is classified as a medium severity vulnerability due to the potential for remote code execution.

How do I fix CVE-2008-5032?

To fix CVE-2008-5032, users should upgrade to a version of VLC media player that is not affected, specifically version 0.9.6 or later.

What systems are affected by CVE-2008-5032?

CVE-2008-5032 affects multiple versions of VideoLAN VLC media player, specifically versions 0.5.0 through 0.9.5.

Is user interaction required for CVE-2008-5032 to be exploited?

Yes, exploiting CVE-2008-5032 typically requires user interaction to open a specially crafted CUE image file.

What type of vulnerability is CVE-2008-5032?

CVE-2008-5032 is a stack-based buffer overflow vulnerability.