CVE-2016-3941

EUVD-2016-4954
Buffer overflow in the AStreamPeekStream function in input/stream.c in VideoLAN VLC media player before 2.2.0 allows remote attackers to cause a denial of service (crash) via a crafted wav file, related to "seek across EOF."
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 53%
Affected Products (NVD)
VendorProductVersion
videolanvlc_media_player
𝑥
≤ 2.1.6
canonicalubuntu_linux
14.04
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
vlc
bookworm
3.0.21-0+deb12u1
fixed
bookworm (security)
3.0.21-0+deb12u1
fixed
bullseye
3.0.21-0+deb11u1
fixed
bullseye (security)
3.0.21-0+deb11u1
fixed
sid
3.0.21-2
fixed
trixie
3.0.21-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
vlc
precise
ignored
trusty
Fixed 2.1.6-0ubuntu14.04.2
released
wily
not-affected
xenial
not-affected
yakkety
not-affected
zesty
not-affected
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00045.html
http://www.securitytracker.com/id/1035456
https://bugs.launchpad.net/ubuntu/+source/vlc/+bug/1533633
https://mailman.videolan.org/pipermail/vlc-commits/2015-January/028938.html
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00045.html
http://www.securitytracker.com/id/1035456
https://bugs.launchpad.net/ubuntu/+source/vlc/+bug/1533633
https://mailman.videolan.org/pipermail/vlc-commits/2015-January/028938.html