CVE-2022-41325 Integer overflow in n/a
Integer overflow in VLC's VNC module allows attackers to crash the application or execute code via crafted playlists or rogue servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-41325?
CVE-2022-41325 is a high-severity vulnerability in Debian Debian Linux, published on 6 Dec 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.
Weakness: CWE-190
Which versions are affected by CVE-2022-41325?
It affects 2 products.
Linux distribution packages (3)
vlc SUSE:Package Hub 15 SP4 | All versions | 3.0.18-bp154.2.3.1 |
vlc openSUSE:Leap 15.4 | All versions | 3.0.18-bp154.2.3.1 |
vlc openSUSE:Tumbleweed | All versions | 3.0.18-4.1 |
Products include Debian Debian Linux, Videolan Vlc Media Player.
How do I fix CVE-2022-41325?
Apply the vendor's patch.
Is CVE-2022-41325 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-41325 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2022-41325, DLA-3216-1, DSA-5297-1, GHSA-xxf6-mj48-xcg3, UBUNTU-CVE-2022-41325, openSUSE-SU-2022:10255-1 and 1 more.