CVE-2017-10699 Memory corruption in n/a
Out-of-bounds heap write in VLC media player allows attackers to cause a crash or potentially execute arbitrary code via crafted media files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-10699?
CVE-2017-10699 is a critical memory corruption vulnerability in Videolan Vlc Media Player, published on 30 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
avcodec 2.2.x, as used in VideoLAN VLC media player 2.2.7-x before 2017-06-29, allows out-of-bounds heap memory write due to calling memcpy() with a wrong size, leading to a denial of service (application crash) or possibly code execution.
Weakness: CWE-787
Which versions are affected by CVE-2017-10699?
It affects 1 product.
Products include Videolan Vlc Media Player.
How do I fix CVE-2017-10699?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-10699 being exploited?
There is no known exploitation of CVE-2017-10699 in the wild and no public exploit code.
Other vulnerabilities in Videolan Vlc Media Player
Sources
Also known as DEBIAN-CVE-2017-10699, GHSA-6367-fpmm-r9xr, MGASA-2017-0424, MGASA-2017-0433, UBUNTU-CVE-2017-10699.