« Volver al listado

CVE-2017-10699

Estado: ModificadaCrítica (9.8)—

avcodec 2.2.x, as used in VideoLAN VLC media player 2.2.7-x before 2017-06-29, allows out-of-bounds heap memory write due to calling memcpy() with a wrong size, leading to a denial of service (application crash) or possibly code execution.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Videolan — VLC Media Player

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-10699",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": true,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-06-30T13:29:00.347",
  "references": [
    {
      "url": "http://www.securitytracker.com/id/1038816",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://trac.videolan.org/vlc/ticket/18467",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.debian.org/security/2017/dsa-4045",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1038816",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://trac.videolan.org/vlc/ticket/18467",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.debian.org/security/2017/dsa-4045",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "avcodec 2.2.x, as used in VideoLAN VLC media player 2.2.7-x before 2017-06-29, allows out-of-bounds heap memory write due to calling memcpy() with a wrong size, leading to a denial of service (application crash) or possibly code execution."
    },
    {
      "lang": "es",
      "value": "avcodec 2.2.x, tal y como se emplea en el reproductor multimedia VideoLAN VLC en versiones 2.2.7-x anteriores a la 2017-06-29, permite una escritura en la memoria dinámica (heap) fuera de límites debido a que se llama a memcpy() con un tamaño erróneo. Esto conduce a una denegación de servicio (cierre inesperado de la aplicación) o a una posible ejecución de código."
    }
  ],
  "lastModified": "2026-06-17T01:00:33.293",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:videolan:vlc_media_player:2.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ECBAF91B-1BC9-4029-ADFC-506FAA3F6C93"
            },
            {
              "criteria": "cpe:2.3:a:videolan:vlc_media_player:2.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3D0E28DE-2CAC-42CD-A8DF-2659AA135772"
            },
            {
              "criteria": "cpe:2.3:a:videolan:vlc_media_player:2.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4F39D96-FC35-4063-BB22-2A4CA6C788D8"
            },
            {
              "criteria": "cpe:2.3:a:videolan:vlc_media_player:2.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2EF54451-B67D-4003-991F-8D306C5ED782"
            },
            {
              "criteria": "cpe:2.3:a:videolan:vlc_media_player:2.2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38860D21-A9DB-49CD-A8CD-3323F98D111F"
            },
            {
              "criteria": "cpe:2.3:a:videolan:vlc_media_player:2.2.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4EC0BA2-715C-4DAD-974D-EFBD3BA51944"
            },
            {
              "criteria": "cpe:2.3:a:videolan:vlc_media_player:2.2.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "86CAC2D1-DD94-4ED2-B8B1-DCE63422852B"
            },
            {
              "criteria": "cpe:2.3:a:videolan:vlc_media_player:2.2.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42B8A2D0-D22A-4196-9013-D3F60CD27C24"
            },
            {
              "criteria": "cpe:2.3:a:videolan:vlc_media_player:2.2.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA1B9AAA-11B1-4215-95B9-92236B81AC99"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}