CVE-2023-47360

Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length.
Wrap or Wraparound
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 22%
VendorProductVersion
videolanvlc_media_player
𝑥
< 3.0.20
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
vlc
bullseye (security)
3.0.21-0+deb11u1
fixed
bullseye
3.0.21-0+deb11u1
fixed
bookworm
3.0.21-0+deb12u1
fixed
bookworm (security)
3.0.21-0+deb12u1
fixed
trixie
3.0.21-2
fixed
sid
3.0.21-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
vlc
oracular
not-affected
noble
not-affected
mantic
Fixed 3.0.18-4ubuntu0.1
released
lunar
ignored
jammy
Fixed 3.0.16-1ubuntu0.1~esm2
released
focal
Fixed 3.0.9.2-1ubuntu0.1~esm2
released
bionic
Fixed 3.0.8-0ubuntu18.04.1+esm2
released
xenial
Fixed 2.2.2-5ubuntu0.16.04.5+esm3
released
trusty
ignored
Common Weakness Enumeration
References
https://0xariana.github.io/blog/real_bugs/vlc/mms
https://lists.debian.org/debian-lts-announce/2023/11/msg00034.html
https://0xariana.github.io/blog/real_bugs/vlc/mms
https://lists.debian.org/debian-lts-announce/2023/11/msg00034.html