« Volver al listado

CVE-2007-6683

Estado: ModificadaMedia (5)—

The browser plugin in VideoLAN VLC 0.8.6d allows remote attackers to overwrite arbitrary files via (1) the :demuxdump-file option in a filename in a playlist, or (2) a EXTVLCOPT statement in an MP3 file, possibly an argument injection vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Videolan — VLC

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-6683",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-01-17T01:00:00.000",
  "references": [
    {
      "url": "http://mailman.videolan.org/pipermail/vlc-devel/2007-December/037726.html",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/42205",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/42206",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/29284",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/29766",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.debian.org/security/2008/dsa-1543",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200803-13.xml",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/28712",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14619",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://trac.videolan.org/vlc/changeset/23197",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://trac.videolan.org/vlc/ticket/1371",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://mailman.videolan.org/pipermail/vlc-devel/2007-December/037726.html",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/42205",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/42206",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/29284",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/29766",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2008/dsa-1543",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200803-13.xml",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/28712",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14619",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://trac.videolan.org/vlc/changeset/23197",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://trac.videolan.org/vlc/ticket/1371",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The browser plugin in VideoLAN VLC 0.8.6d allows remote attackers to overwrite arbitrary files via (1) the :demuxdump-file option in a filename in a playlist, or (2) a EXTVLCOPT statement in an MP3 file, possibly an argument injection vulnerability."
    },
    {
      "lang": "es",
      "value": "La extensión de navegación de VideoLAN VLC 0.8.6d permite a atacantes remotos sobrescribir ficheros de su elección mediante (1) la opción :demuxdump-file en un nombre de fichero de una lista de reproducción, o (2) una sentencia EXTVLCOPT en un fichero MP3, posiblemente una vulnerabilidad de inyección de argumento."
    }
  ],
  "lastModified": "2026-06-16T22:48:34.170",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:videolan:vlc:0.8.6d:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "686E1C6D-CDE6-4615-B983-3BCDDDE921AD"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}