CVE-2017-8311

7.8 HIGH

Published: May 23, 2017 Modified: May 13, 2026

Description

Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=775de716add17322f24b476439f903a829446eb6

Source: cve@checkpoint.com

http://www.debian.org/security/2017/dsa-3899

Source: cve@checkpoint.com

http://www.securityfocus.com/bid/98634

Source: cve@checkpoint.com

https://security.gentoo.org/glsa/201707-10

Source: cve@checkpoint.com

https://www.exploit-db.com/exploits/44514/

Source: cve@checkpoint.com

http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=775de716add17322f24b476439f903a829446eb6