CVE-2011-0522: Buffer Overflow
The StripTags function in (1) the USF decoder (modules/codec/subtitles/subsdec.c) and (2) the Text decoder (modules/codec/subtitles/subsusf.c) in VideoLAN VLC Media Player 1.1 before 1.1.6-rc allows remote attackers to execute arbitrary code via a subtitle with an opening "<" without a closing ">" in an MKV file, which triggers heap memory corruption, as demonstrated using refined-australia-blu720p-sample.mkv.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0522?
CVE-2011-0522 has been rated as critical due to its potential to allow remote code execution.
How do I fix CVE-2011-0522?
To fix CVE-2011-0522, upgrade VLC Media Player to version 1.1.6 or later.
What software versions are affected by CVE-2011-0522?
VLC Media Player versions 1.1.0 through 1.1.5 are affected by CVE-2011-0522.
Can CVE-2011-0522 be exploited through subtitles?
Yes, CVE-2011-0522 can be exploited by using specially crafted subtitles with unclosed tags.
What are the potential implications of CVE-2011-0522?
Exploitation of CVE-2011-0522 can allow attackers to execute arbitrary code on a victim's machine.