CVE-2017-10699
First published: Fri Jun 30 2017(Updated: )
avcodec 2.2.x, as used in VideoLAN VLC media player 2.2.7-x before 2017-06-29, allows out-of-bounds heap memory write due to calling memcpy() with a wrong size, leading to a denial of service (application crash) or possibly code execution.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/vlc | 3.0.17.4-0+deb10u1 3.0.17.4-0+deb10u2 3.0.18-0+deb11u1 3.0.18-2 3.0.19-1 | |
| Videolan Vlc Media Player | =2.2.0 | |
| Videolan Vlc Media Player | =2.2.1 | |
| Videolan Vlc Media Player | =2.2.2 | |
| Videolan Vlc Media Player | =2.2.3 | |
| Videolan Vlc Media Player | =2.2.4 | |
| Videolan Vlc Media Player | =2.2.5 | |
| Videolan Vlc Media Player | =2.2.5.1 | |
| Videolan Vlc Media Player | =2.2.6 | |
| Videolan Vlc Media Player | =2.2.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.videolan.org/?p=vlc/vlc-2.2.git;a=commitdiff;h=6cc73bcad19da2cd2e95671173f2e0d203a57e9b
- https://git.videolan.org/?p=vlc/vlc-2.2.git;a=commitdiff;h=a38a85db58c569cc592d9380cc07096757ef3d49
- https://trac.videolan.org/vlc/ticket/18467
- https://security-tracker.debian.org/tracker/CVE-2017-10699
- http://www.securitytracker.com/id/1038816
- https://www.debian.org/security/2017/dsa-4045
Frequently Asked Questions
What is the severity of CVE-2017-10699?
The severity of CVE-2017-10699 is assessed as critical, with a score of 9.8.
How do I fix CVE-2017-10699?
To fix CVE-2017-10699, update VLC media player to version 3.0.17.4 or later.
What vulnerabilities does CVE-2017-10699 exploit?
CVE-2017-10699 exploits an out-of-bounds heap memory write due to incorrect parameters in memcpy().
Which versions of VLC media player are affected by CVE-2017-10699?
Affected versions include VLC media player 2.2.0 through 2.2.7.
What is the potential impact of CVE-2017-10699?
The potential impact of CVE-2017-10699 includes denial of service or possible remote code execution.
- collector/security-tracker-debian
- collector/nvd-index
- package-manager/debian
- vendor/videolan
- product/vlc media player
- canonical/videolan vlc media player