CVE-2008-4686

Multiple integer overflows in ty.c in the TY demux plugin (aka the TiVo demuxer) in VideoLAN VLC media player, probably 0.9.4, might allow remote attackers to execute arbitrary code via a crafted .ty file, a different vulnerability than CVE-2008-4654.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:C/I:C/A:C
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 93%
VendorProductVersion
videolanvlc_media_player
0.9.0
videolanvlc_media_player
0.9.1
videolanvlc_media_player
0.9.2
videolanvlc_media_player
0.9.3
videolanvlc_media_player
0.9.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
vlc
bullseye (security)
3.0.21-0+deb11u1
fixed
bullseye
3.0.21-0+deb11u1
fixed
bookworm
3.0.21-0+deb12u1
fixed
bookworm (security)
3.0.21-0+deb12u1
fixed
sid
3.0.21-2
fixed
trixie
3.0.21-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
vlc
karmic
not-affected
jaunty
not-affected
intrepid
Fixed 0.9.4-1ubuntu3.2
released
hardy
not-affected
gutsy
ignored
dapper
ignored
Common Weakness Enumeration
References
http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=d859e6b9537af2d7326276f70de25a840f554dc3
http://www.openwall.com/lists/oss-security/2008/10/19/2
http://www.openwall.com/lists/oss-security/2008/10/22/6
http://www.securityfocus.com/bid/31867
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14630
http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=d859e6b9537af2d7326276f70de25a840f554dc3
http://www.openwall.com/lists/oss-security/2008/10/19/2
http://www.openwall.com/lists/oss-security/2008/10/22/6
http://www.securityfocus.com/bid/31867
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14630