Vulnerability Details : CVE-2018-11516
The vlc_demux_chained_Delete function in input/demux_chained.c in VideoLAN VLC media player 3.0.1 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly have unspecified other impact via a crafted .swf file.
Vulnerability category: Denial of service
Products affected by CVE-2018-11516
- cpe:2.3:a:videolan:vlc_media_player:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:videolan:vlc_media_player:3.0.0:*:*:*:*:*:*:*
Threat overview for CVE-2018-11516
Top countries where our scanners detected CVE-2018-11516
Top open port discovered on systems with this issue
8080
IPs affected by CVE-2018-11516 10
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2018-11516!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2018-11516
0.53%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 74 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-11516
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2018-11516
-
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-11516
-
http://www.videolan.org/security/sa1801.html
VideoLAN Security Advisory 1801 - VideoLANThird Party Advisory
-
http://www.securitytracker.com/id/1041312
VLC Media Player Use-After-Free Memory Error in Processing SWF Files Lets Remote Users Execute Arbitrary Code - SecurityTrackerBroken Link;Third Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/104293
VideoLAN VLC 'input/demux_chained.c' Denial of Service VulnerabilityBroken Link;Third Party Advisory;VDB Entry
-
http://code610.blogspot.com/2018/05/make-free-vlc.html
code16: Make free the VLCExploit;Third Party Advisory
Jump to