CVE-2017-17670

HIGH

VLC media player < 2.2.8 - Use-After-Free in MP4 Demux Module

Title source: llm
STIX 2.1

Description

In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules/demux/mp4/libmp4.c in the MP4 demux module leading to a invalid free, because the type of a box may be changed between a read operation and a free operation.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/102214
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1040938
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4203
Exploit, Mailing List, Third Party Advisory x_refsource_misc
http://openwall.com/lists/oss-security/2017/12/15/1

Scores

CVSS v3 8.8
EPSS 0.0215
EPSS Percentile 80.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-416
Status published
Products (2)
debian/debian_linux 9.0
videolan/vlc_media_player < 2.2.8
Published Dec 15, 2017
Tracked Since Feb 18, 2026