CVE-2017-8313: Medium severity vlc media player vulnerability
Published May 23, 2017
·Updated
Heap out-of-bound read in ParseJSS in VideoLAN VLC before 2.2.5 due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process via a crafted subtitles file.
Affected Software
1 affected component
Videolan VLC Media Player<=2.2.4
Remediation
Event History
May 23, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-8313?
CVE-2017-8313 has been classified as a moderate severity vulnerability due to the potential for denial of service.
2
How do I fix CVE-2017-8313?
To fix CVE-2017-8313, upgrade VLC media player to version 2.2.5 or later.
3
What causes CVE-2017-8313?
CVE-2017-8313 is caused by a heap out-of-bounds read due to missing checks for string termination in the ParseJSS function.
4
Which versions of VLC media player are affected by CVE-2017-8313?
VLC media player versions prior to 2.2.5 are affected by CVE-2017-8313.
5
Can CVE-2017-8313 lead to arbitrary code execution?
CVE-2017-8313 does not lead to arbitrary code execution but can potentially crash the VLC process.