CVE-2024-46461
VLC Media Player MMS Heap Based Overflow Vulnerability
Description
VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stream (heap based overflow). If successful, a malicious third party could trigger either a crash of VLC or an arbitrary code execution with the target user's privileges.
INFO
Published Date :
Sept. 25, 2024, 3:15 p.m.
Last Modified :
Sept. 26, 2024, 1:32 p.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
5.9
Exploitability Score :
2.1
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-46461.
| URL | Resource |
|---|---|
| https://www.videolan.org/security/sb-vlc3021.html |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-46461 vulnerability anywhere in the article.
-
Cybersecurity News
Microsoft Windows Flaw: CVE-2024-30090 PoC Exploit Published, Posing SYSTEM Privilege Threat
Security researcher Angelboy (@scwuaptx) with DEVCORE has identified a privilege escalation vulnerability in Microsoft’s Kernel Streaming service. The vulnerability, tracked as CVE-2024-30090 and assi ... Read more
-
Cybersecurity News
LockBit Imposter: New Ransomware Leverages AWS for Attacks
The sample’s attack flow | Image: Trend MicroIn a detailed report by Trend Micro, cybersecurity researchers uncovered a sophisticated ransomware operation abusing Amazon Web Services (AWS) infrastruct ... Read more
-
Cybersecurity News
PoC Exploit Releases for CVE-2024-44193: Local Privilege Escalation Vulnerability in iTunes
Image: mbog14 Security researcher mbog14 has published the technical details and proof-of-concept for a critical local privilege escalation (LPE) vulnerability affecting iTunes version 12.13.2.3, iden ... Read more
-
TheCyberThrone
CUPS Vulnerability affecting Linux Print Server
There’s has been a spotlight on one of the vulnerability reported critical unauthenticated remote code execution flaws affecting Linux systems.Security researcher Simone Margaritelli discovered this v ... Read more
-
Cybersecurity News
Critical Vulnerabilities in Kia’s Dealer Portal Expose Millions of Vehicles to Remote Hijacking
Image: SamcurryIn a startling revelation that underscores the growing cybersecurity risks in the automotive industry, security researchers have uncovered critical vulnerabilities in Kia’s dealer porta ... Read more
-
TheCyberThrone
VLC Player Vulnerability CVE-2024-46461
VLC media player has been traced with a vulnerability that could allow malicious actors to crash the program or even execute arbitrary code.The vulnerability tracked as CVE-2024-46461, with a CVSS sco ... Read more
-
Cybersecurity News
VLC Media Player Update Needed: CVE-2024-46461 Discovered
Users of the popular VLC media player are being urged to update their software immediately following the discovery of a critical vulnerability that could allow malicious actors to crash the program or ... Read more
The following table lists the changes that have been made to the
CVE-2024-46461 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Sep. 25, 2024
Action Type Old Value New Value Added CWE CISA-ADP CWE-122 Added CVSS V3.1 CISA-ADP AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H -
CVE Received by [email protected]
Sep. 25, 2024
Action Type Old Value New Value Added Description VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stream (heap based overflow). If successful, a malicious third party could trigger either a crash of VLC or an arbitrary code execution with the target user's privileges. Added Reference MITRE https://www.videolan.org/security/sb-vlc3021.html [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-46461 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-46461
weaknesses.