CVE-2008-2430 - Vulnerability Details - OpenCVE

Integer overflow in the Open function in modules/demux/wav.c in VLC Media Player 0.8.6h on Windows allows remote attackers to execute arbitrary code via a large fmt chunk in a WAV file.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.0843.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft	Windows Nt
Videolan	Vlc Media Player

Configuration 1 [-]

AND

cpe:2.3:o:microsoft:windows_nt:*:*:*:*:*:*:*:*

cpe:2.3:a:videolan:vlc_media_player:0.8.6h:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
Debian DSA	DSA-1819-1	New vlc packages fix several vulnerabilities
EUVD	EUVD-2008-2425	Integer overflow in the Open function in modules/demux/wav.c in VLC Media Player 0.8.6h on Windows allows remote attackers to execute arbitrary code via a large fmt chunk in a WAV file.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://secunia.com/advisories/30601
http://secunia.com/advisories/31317
http://secunia.com/secunia_research/2008-29/advisory/
http://security.gentoo.org/glsa/glsa-200807-13.xml
http://securityreason.com/securityalert/3976
http://www.securityfocus.com/archive/1/493849/100/0/threaded
http://www.securityfocus.com/bid/30058
http://www.securitytracker.com/id?1020429
http://www.videolan.org/developers/vlc/NEWS
http://www.vupen.com/english/advisories/2008/1995/references
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14344
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14769

History

No history.

MITRE

Status: PUBLISHED

Assigner: flexera

Published: 2008-07-07T23:00:00

Updated: 2024-08-07T08:58:02.620Z

Reserved: 2008-05-27T00:00:00

Link: CVE-2008-2430

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2008-07-07T23:41:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2008-2430

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-07-02T00:00:00", "descriptions": [{"lang": "en", "value": "Integer overflow in the Open function in modules/demux/wav.c in VLC Media Player 0.8.6h on Windows allows remote attackers to execute arbitrary code via a large fmt chunk in a WAV file."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-11T19:57:01", "orgId": "44d08088-2bea-4760-83a6-1e9be26b15ab", "shortName": "flexera"}, "references": [{"name": "31317", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/31317"}, {"name": "3976", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/3976"}, {"name": "1020429", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1020429"}, {"name": "GLSA-200807-13", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "http://security.gentoo.org/glsa/glsa-200807-13.xml"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.videolan.org/developers/vlc/NEWS"}, {"name": "oval:org.mitre.oval:def:14344", "tags": ["vdb-entry", "signature", "x_refsource_OVAL"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14344"}, {"name": "ADV-2008-1995", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2008/1995/references"}, {"name": "oval:org.mitre.oval:def:14769", "tags": ["vdb-entry", "signature", "x_refsource_OVAL"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14769"}, {"name": "20080702 Secunia Research: VLC Media Player WAV Processing Integer Overflow", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/493849/100/0/threaded"}, {"tags": ["x_refsource_MISC"], "url": "http://secunia.com/secunia_research/2008-29/advisory/"}, {"name": "30601", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/30601"}, {"name": "30058", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/30058"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "PSIRT-CNA@flexerasoftware.com", "ID": "CVE-2008-2430", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Integer overflow in the Open function in modules/demux/wav.c in VLC Media Player 0.8.6h on Windows allows remote attackers to execute arbitrary code via a large fmt chunk in a WAV file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "31317", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/31317"}, {"name": "3976", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/3976"}, {"name": "1020429", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1020429"}, {"name": "GLSA-200807-13", "refsource": "GENTOO", "url": "http://security.gentoo.org/glsa/glsa-200807-13.xml"}, {"name": "http://www.videolan.org/developers/vlc/NEWS", "refsource": "CONFIRM", "url": "http://www.videolan.org/developers/vlc/NEWS"}, {"name": "oval:org.mitre.oval:def:14344", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14344"}, {"name": "ADV-2008-1995", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2008/1995/references"}, {"name": "oval:org.mitre.oval:def:14769", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14769"}, {"name": "20080702 Secunia Research: VLC Media Player WAV Processing Integer Overflow", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/493849/100/0/threaded"}, {"name": "http://secunia.com/secunia_research/2008-29/advisory/", "refsource": "MISC", "url": "http://secunia.com/secunia_research/2008-29/advisory/"}, {"name": "30601", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/30601"}, {"name": "30058", "refsource": "BID", "url": "http://www.securityfocus.com/bid/30058"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T08:58:02.620Z"}, "title": "CVE Program Container", "references": [{"name": "31317", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/31317"}, {"name": "3976", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/3976"}, {"name": "1020429", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1020429"}, {"name": "GLSA-200807-13", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "http://security.gentoo.org/glsa/glsa-200807-13.xml"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.videolan.org/developers/vlc/NEWS"}, {"name": "oval:org.mitre.oval:def:14344", "tags": ["vdb-entry", "signature", "x_refsource_OVAL", "x_transferred"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14344"}, {"name": "ADV-2008-1995", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2008/1995/references"}, {"name": "oval:org.mitre.oval:def:14769", "tags": ["vdb-entry", "signature", "x_refsource_OVAL", "x_transferred"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14769"}, {"name": "20080702 Secunia Research: VLC Media Player WAV Processing Integer Overflow", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/493849/100/0/threaded"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://secunia.com/secunia_research/2008-29/advisory/"}, {"name": "30601", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/30601"}, {"name": "30058", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/30058"}]}]}, "cveMetadata": {"assignerOrgId": "44d08088-2bea-4760-83a6-1e9be26b15ab", "assignerShortName": "flexera", "cveId": "CVE-2008-2430", "datePublished": "2008-07-07T23:00:00", "dateReserved": "2008-05-27T00:00:00", "dateUpdated": "2024-08-07T08:58:02.620Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_nt:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED27882B-A02A-4D5F-9117-A47976C676E0", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:videolan:vlc_media_player:0.8.6h:*:*:*:*:*:*:*", "matchCriteriaId": "725D145D-C3F6-4810-96D8-E8AC871093F0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Integer overflow in the Open function in modules/demux/wav.c in VLC Media Player 0.8.6h on Windows allows remote attackers to execute arbitrary code via a large fmt chunk in a WAV file."}, {"lang": "es", "value": "Desbordamiento de entero en la Funci\u00f3n Open en modules/demux/wav.c en VLC Media Player 0.8.6h ejecutado sobre Windows, permite a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de un fragmento fmt de gran tama\u00f1o en un archivo WAV."}], "id": "CVE-2008-2430", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2008-07-07T23:41:00.000", "references": [{"source": "PSIRT-CNA@flexerasoftware.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/30601"}, {"source": "PSIRT-CNA@flexerasoftware.com", "url": "http://secunia.com/advisories/31317"}, {"source": "PSIRT-CNA@flexerasoftware.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/secunia_research/2008-29/advisory/"}, {"source": "PSIRT-CNA@flexerasoftware.com", "url": "http://security.gentoo.org/glsa/glsa-200807-13.xml"}, {"source": "PSIRT-CNA@flexerasoftware.com", "url": "http://securityreason.com/securityalert/3976"}, {"source": "PSIRT-CNA@flexerasoftware.com", "url": "http://www.securityfocus.com/archive/1/493849/100/0/threaded"}, {"source": "PSIRT-CNA@flexerasoftware.com", "url": "http://www.securityfocus.com/bid/30058"}, {"source": "PSIRT-CNA@flexerasoftware.com", "url": "http://www.securitytracker.com/id?1020429"}, {"source": "PSIRT-CNA@flexerasoftware.com", "url": "http://www.videolan.org/developers/vlc/NEWS"}, {"source": "PSIRT-CNA@flexerasoftware.com", "url": "http://www.vupen.com/english/advisories/2008/1995/references"}, {"source": "PSIRT-CNA@flexerasoftware.com", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14344"}, {"source": "PSIRT-CNA@flexerasoftware.com", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14769"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/30601"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/31317"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/secunia_research/2008-29/advisory/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://security.gentoo.org/glsa/glsa-200807-13.xml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/3976"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/493849/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/30058"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1020429"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.videolan.org/developers/vlc/NEWS"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2008/1995/references"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14344"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14769"}], "sourceIdentifier": "PSIRT-CNA@flexerasoftware.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-189"}], "source": "nvd@nist.gov", "type": "Primary"}]}