Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-47360
CVE-2023-47360:
VLC media player vulnerability analysis and mitigation
Overview
Videolan VLC media player versions prior to 3.0.20 contain an Integer underflow vulnerability (CVE-2023-47360) that leads to an incorrect packet length in the MMS (Microsoft Media Server) protocol implementation (NVD, CVE). The vulnerability was discovered and reported on September 1, 2023, and was fixed in VLC version 3.0.20 released on October 30, 2023.
Technical details
The vulnerability exists in the MMSH (MMS over HTTP) module of VLC. When calculating the data size in the GetPacket function, there is an integer underflow vulnerability due to improper handling of the isize2 parameter. The calculation p_ck->i_data = p_ck->i_size2 - 8 can result in an underflow because isize2 is a uint16t type while idata is an int type (VLC Blog). The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).
Impact
The integer underflow vulnerability can lead to incorrect packet length calculations in the MMS protocol implementation, potentially affecting the availability of the VLC media player (NVD). This could result in application crashes or other undefined behavior when processing MMS streams.
Mitigation and workarounds
Users are advised to upgrade to VLC version 3.0.20 or later which contains the fix for this vulnerability. The fix was released on October 30, 2023, and has been backported to various Linux distributions (Debian LTS). The vulnerability was fixed through proper handling of packet length calculations in the MMSH module.
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management