National Cyber Awareness System

Vulnerability Summary for CVE-2011-0531

Overview

demux/mkv/mkv.hpp in the MKV demuxer plugin in VideoLAN VLC media player 1.1.6.1 and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary commands via a crafted MKV (WebM or Matroska) file that triggers memory corruption, related to "class mismatching" and the MKV_IS_ID macro.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://www.videolan.org/security/sa1102.html

Type: Advisory; Patch Information

Hyperlink:http://www.videolan.org/security/sa1102.html

External Source: MLIST

Name: [oss-security] 20110131 Re: CVE request: code execution in VLC media player

Type: Patch Information

Hyperlink:http://www.openwall.com/lists/oss-security/2011/01/31/8

External Source: MLIST

Name: [oss-security] 20110131 CVE request: code execution in VLC media player

Type: Patch Information

Hyperlink:http://www.openwall.com/lists/oss-security/2011/01/31/4

External Source: CONFIRM

Name: http://git.videolan.org/?p=vlc.git;a=commit;h=59491dcedffbf97612d2c572943b56ee4289dd07

Type: Patch Information

Hyperlink:http://git.videolan.org/?p=vlc.git;a=commit;h=59491dcedffbf97612d2c572943b56ee4289dd07

External Source: XF

Name: vlc-mkv-code-execution(65045)

Hyperlink:http://xforce.iss.net/xforce/xfdb/65045

External Source: VUPEN

Name: ADV-2011-0363

Hyperlink:http://www.vupen.com/english/advisories/2011/0363

External Source: SECTRACK

Name: 1025018

Hyperlink:http://www.securitytracker.com/id?1025018

External Source: BID

Name: 46060

Hyperlink:http://www.securityfocus.com/bid/46060

External Source: DEBIAN

Name: DSA-2159

Hyperlink:http://www.debian.org/security/2011/dsa-2159

External Source: SECUNIA

Name: 43242

Hyperlink:http://secunia.com/advisories/43242

External Source: SECUNIA

Name: 43131

Type: Advisory

Hyperlink:http://secunia.com/advisories/43131

External Source: OVAL

Name: oval:org.mitre.oval:def:12415

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12415

External Source: OSVDB

Name: 70698

Hyperlink:http://osvdb.org/70698

References to Check Content

Identifier:oval:org.mitre.oval:def:12415

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:12415