Vulnerability-Lookup

BDU:2019-03961

Vulnerability from fstec - Published: 02.01.2007

Title

Description

Множественные уязвимости функций cdio_log_handler (modules/access/cdda/access.c) плагина CDDA (libcdda_plugin) и cdio_log_handler, vcd_log_handler (modules/access/vcdx/access.c) плагина VCDX (libvcdx_plugin) программы-медиапроигрывателя VideoLAN VLC связана с использованием неконтролируемых форматных строк. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код

Severity


                    
                      AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Vendor

ООО «РусБИТех-Астра», VideoLAN organization, Сообщество свободного программного обеспечения

Software Name

Astra Linux Special Edition (запись в едином реестре российских программ №369), VLC Media Player, Debian GNU/Linux

Software Version

1.6 «Смоленск» (Astra Linux Special Edition), 0.8.5 (VLC Media Player), 0.8.1 (VLC Media Player), 3.1 (Debian GNU/Linux), 0.7.0 (VLC Media Player), 0.7.1 (VLC Media Player), 0.7.2 (VLC Media Player), 0.8.0 (VLC Media Player), 0.8.2 (VLC Media Player), 0.8.4 (VLC Media Player), 0.8.4a (VLC Media Player), 0.8.6 (VLC Media Player), 4 (Debian GNU/Linux)

Possible Mitigations

Использование рекомендаций: Для Astra Linux: https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734 Для VLC Media Player: https://www.videolan.org/security/sa0701.html Для Debian GNU/Linux: https://www.debian.org/security/2007/dsa-1252

Reference

https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734 https://nvd.nist.gov/vuln/detail/CVE-2007-0017 https://www.cvedetails.com/cve/CVE-2007-0017/ https://exchange.xforce.ibmcloud.com/vulnerabilities/31226 https://www.videolan.org/security/sa0701.html https://www.debian.org/security/2007/dsa-1252 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=405425

CWE

CWE-134

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
  "CVSS 3.0": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb, VideoLAN organization, \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "1.6 \u00ab\u0421\u043c\u043e\u043b\u0435\u043d\u0441\u043a\u00bb (Astra Linux Special Edition), 0.8.5 (VLC Media Player), 0.8.1 (VLC Media Player), 3.1 (Debian GNU/Linux), 0.7.0 (VLC Media Player), 0.7.1 (VLC Media Player), 0.7.2 (VLC Media Player), 0.8.0 (VLC Media Player), 0.8.2 (VLC Media Player), 0.8.4 (VLC Media Player), 0.8.4a (VLC Media Player), 0.8.6 (VLC Media Player), 4 (Debian GNU/Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Astra Linux:\nhttps://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734\n\n\u0414\u043b\u044f VLC Media Player:\nhttps://www.videolan.org/security/sa0701.html\n\n\u0414\u043b\u044f Debian GNU/Linux:\nhttps://www.debian.org/security/2007/dsa-1252",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "02.01.2007",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "11.11.2019",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "11.11.2019",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2019-03961",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2007-0017",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Astra Linux Special Edition (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), VLC Media Player, Debian GNU/Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "\u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Special Edition 1.6 \u00ab\u0421\u043c\u043e\u043b\u0435\u043d\u0441\u043a\u00bb  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), Microsoft Corp Windows - , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 3.1 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 4 ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 cdio_log_handler (modules/access/cdda/access.c) \u043f\u043b\u0430\u0433\u0438\u043d\u0430 CDDA (libcdda_plugin) \u0438 cdio_log_handler, vcd_log_handler (modules/access/vcdx/access.c) \u043f\u043b\u0430\u0433\u0438\u043d\u0430 VCDX (libvcdx_plugin) \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u043c\u0435\u0434\u0438\u0430\u043f\u0440\u043e\u0438\u0433\u0440\u044b\u0432\u0430\u0442\u0435\u043b\u044f VideoLAN VLC, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0444\u043e\u0440\u043c\u0430\u0442\u043d\u0430\u044f \u0441\u0442\u0440\u043e\u043a\u0430 (CWE-134)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 cdio_log_handler (modules/access/cdda/access.c) \u043f\u043b\u0430\u0433\u0438\u043d\u0430 CDDA (libcdda_plugin) \u0438 cdio_log_handler, vcd_log_handler (modules/access/vcdx/access.c) \u043f\u043b\u0430\u0433\u0438\u043d\u0430 VCDX (libvcdx_plugin) \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u043c\u0435\u0434\u0438\u0430\u043f\u0440\u043e\u0438\u0433\u0440\u044b\u0432\u0430\u0442\u0435\u043b\u044f VideoLAN VLC \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0444\u043e\u0440\u043c\u0430\u0442\u043d\u044b\u0445 \u0441\u0442\u0440\u043e\u043a. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734\nhttps://nvd.nist.gov/vuln/detail/CVE-2007-0017\nhttps://www.cvedetails.com/cve/CVE-2007-0017/\nhttps://exchange.xforce.ibmcloud.com/vulnerabilities/31226\nhttps://www.videolan.org/security/sa0701.html\nhttps://www.debian.org/security/2007/dsa-1252\nhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=405425",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-134",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,8)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5)"
}

CVE-2007-0017 (GCVE-0-2007-0017)

Vulnerability from cvelistv5 – Published: 2007-01-03 02:00 – Updated: 2024-08-07 12:03

Summary

Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an invalid URI, as demonstrated by a udp://-- URI in an M3U file.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

20 references

URL	Tags
http://www.securityfocus.com/bid/21852	vdb-entryx_refsource_BID
http://www.vupen.com/english/advisories/2007/0026	vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/23971	third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://osvdb.org/31163	vdb-entryx_refsource_OSVDB
http://www.novell.com/linux/security/advisories/2…	vendor-advisoryx_refsource_SUSE
http://securitytracker.com/id?1017464	vdb-entryx_refsource_SECTRACK
http://secunia.com/advisories/23829	third-party-advisoryx_refsource_SECUNIA
http://www.videolan.org/patches/vlc-0.8.6-MOAB-02…	x_refsource_CONFIRM
http://secunia.com/advisories/23592	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/23910	third-party-advisoryx_refsource_SECUNIA
http://applefun.blogspot.com/2007/01/moab-02-01-2…	x_refsource_MISC
http://security.gentoo.org/glsa/glsa-200701-24.xml	vendor-advisoryx_refsource_GENTOO
http://projects.info-pull.com/moab/MOAB-02-01-2007.html	x_refsource_MISC
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://www.videolan.org/sa0701.html	x_refsource_CONFIRM
http://trac.videolan.org/vlc/changeset/18481	x_refsource_CONFIRM
http://www.via.ecp.fr/via/ml/vlc-devel/2007-01/ms…	mailing-listx_refsource_MLIST
http://www.debian.org/security/2007/dsa-1252	vendor-advisoryx_refsource_DEBIAN
http://landonf.bikemonkey.org/code/macosx/MOAB_Da…	x_refsource_MISC

Date Public

2007-01-02 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T12:03:36.539Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "21852",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/21852"
          },
          {
            "name": "ADV-2007-0026",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/0026"
          },
          {
            "name": "23971",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23971"
          },
          {
            "name": "vlcmediaplayer-udp-format-string(31226)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31226"
          },
          {
            "name": "31163",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/31163"
          },
          {
            "name": "SUSE-SA:2007:013",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.novell.com/linux/security/advisories/2007_13_xine.html"
          },
          {
            "name": "1017464",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1017464"
          },
          {
            "name": "23829",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23829"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.videolan.org/patches/vlc-0.8.6-MOAB-02-01-2007.patch"
          },
          {
            "name": "23592",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23592"
          },
          {
            "name": "23910",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23910"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://applefun.blogspot.com/2007/01/moab-02-01-2007-vlc-media-player-udp.html"
          },
          {
            "name": "GLSA-200701-24",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200701-24.xml"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://projects.info-pull.com/moab/MOAB-02-01-2007.html"
          },
          {
            "name": "oval:org.mitre.oval:def:14313",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14313"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.videolan.org/sa0701.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://trac.videolan.org/vlc/changeset/18481"
          },
          {
            "name": "[vlc-devel] 20070102 Security hole in VLC media player for Mac...",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.via.ecp.fr/via/ml/vlc-devel/2007-01/msg00005.html"
          },
          {
            "name": "DSA-1252",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2007/dsa-1252"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://landonf.bikemonkey.org/code/macosx/MOAB_Day_2.20070103045559.6753.timor.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-01-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an invalid URI, as demonstrated by a udp://-- URI in an M3U file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-10T00:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "21852",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/21852"
        },
        {
          "name": "ADV-2007-0026",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/0026"
        },
        {
          "name": "23971",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23971"
        },
        {
          "name": "vlcmediaplayer-udp-format-string(31226)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31226"
        },
        {
          "name": "31163",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/31163"
        },
        {
          "name": "SUSE-SA:2007:013",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.novell.com/linux/security/advisories/2007_13_xine.html"
        },
        {
          "name": "1017464",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1017464"
        },
        {
          "name": "23829",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23829"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.videolan.org/patches/vlc-0.8.6-MOAB-02-01-2007.patch"
        },
        {
          "name": "23592",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23592"
        },
        {
          "name": "23910",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23910"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://applefun.blogspot.com/2007/01/moab-02-01-2007-vlc-media-player-udp.html"
        },
        {
          "name": "GLSA-200701-24",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200701-24.xml"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://projects.info-pull.com/moab/MOAB-02-01-2007.html"
        },
        {
          "name": "oval:org.mitre.oval:def:14313",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14313"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.videolan.org/sa0701.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://trac.videolan.org/vlc/changeset/18481"
        },
        {
          "name": "[vlc-devel] 20070102 Security hole in VLC media player for Mac...",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.via.ecp.fr/via/ml/vlc-devel/2007-01/msg00005.html"
        },
        {
          "name": "DSA-1252",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2007/dsa-1252"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://landonf.bikemonkey.org/code/macosx/MOAB_Day_2.20070103045559.6753.timor.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-0017",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an invalid URI, as demonstrated by a udp://-- URI in an M3U file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "21852",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/21852"
            },
            {
              "name": "ADV-2007-0026",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/0026"
            },
            {
              "name": "23971",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23971"
            },
            {
              "name": "vlcmediaplayer-udp-format-string(31226)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31226"
            },
            {
              "name": "31163",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/31163"
            },
            {
              "name": "SUSE-SA:2007:013",
              "refsource": "SUSE",
              "url": "http://www.novell.com/linux/security/advisories/2007_13_xine.html"
            },
            {
              "name": "1017464",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1017464"
            },
            {
              "name": "23829",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23829"
            },
            {
              "name": "http://www.videolan.org/patches/vlc-0.8.6-MOAB-02-01-2007.patch",
              "refsource": "CONFIRM",
              "url": "http://www.videolan.org/patches/vlc-0.8.6-MOAB-02-01-2007.patch"
            },
            {
              "name": "23592",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23592"
            },
            {
              "name": "23910",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23910"
            },
            {
              "name": "http://applefun.blogspot.com/2007/01/moab-02-01-2007-vlc-media-player-udp.html",
              "refsource": "MISC",
              "url": "http://applefun.blogspot.com/2007/01/moab-02-01-2007-vlc-media-player-udp.html"
            },
            {
              "name": "GLSA-200701-24",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200701-24.xml"
            },
            {
              "name": "http://projects.info-pull.com/moab/MOAB-02-01-2007.html",
              "refsource": "MISC",
              "url": "http://projects.info-pull.com/moab/MOAB-02-01-2007.html"
            },
            {
              "name": "oval:org.mitre.oval:def:14313",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14313"
            },
            {
              "name": "http://www.videolan.org/sa0701.html",
              "refsource": "CONFIRM",
              "url": "http://www.videolan.org/sa0701.html"
            },
            {
              "name": "http://trac.videolan.org/vlc/changeset/18481",
              "refsource": "CONFIRM",
              "url": "http://trac.videolan.org/vlc/changeset/18481"
            },
            {
              "name": "[vlc-devel] 20070102 Security hole in VLC media player for Mac...",
              "refsource": "MLIST",
              "url": "http://www.via.ecp.fr/via/ml/vlc-devel/2007-01/msg00005.html"
            },
            {
              "name": "DSA-1252",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2007/dsa-1252"
            },
            {
              "name": "http://landonf.bikemonkey.org/code/macosx/MOAB_Day_2.20070103045559.6753.timor.html",
              "refsource": "MISC",
              "url": "http://landonf.bikemonkey.org/code/macosx/MOAB_Day_2.20070103045559.6753.timor.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-0017",
    "datePublished": "2007-01-03T02:00:00.000Z",
    "dateReserved": "2007-01-02T00:00:00.000Z",
    "dateUpdated": "2024-08-07T12:03:36.539Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

BDU:2019-03961

CVE-2007-0017 (GCVE-0-2007-0017)

Tags

Sightings

Nomenclature