CVE-2007-6262 Memory corruption in n/a
Remote attackers can execute arbitrary code via crafted arguments to ActiveX controls in VLC media player, requiring user interaction to trigger the vulnerability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2007-6262?
CVE-2007-6262 is a medium-severity memory corruption vulnerability in Videolan Vlc Media Player, published on 6 Dec 2007. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A certain ActiveX control in axvlc.dll in VideoLAN VLC 0.8.6 before 0.8.6d allows remote attackers to execute arbitrary code via crafted arguments to the (1) addTarget, (2) getVariable, or (3) setVariable function, resulting from a "bad initialized pointer," aka a "recursive plugin release vulnerability."
Weakness: CWE-119
Which versions are affected by CVE-2007-6262?
It affects 1 product.
Products include Videolan Vlc Media Player.
How do I fix CVE-2007-6262?
No fix has been published for CVE-2007-6262 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2007-6262 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-6262 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Videolan Vlc Media Player
Sources
Also known as GHSA-crj9-mr7m-c86x.