CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
EPSS
Percentile
81.9%
DISPUTED plugins/demux/libmkv_plugin.dll in VideoLAN VLC Media Player
2.0.7, and possibly other versions, allows remote attackers to cause a
denial of service (crash) and possibly execute arbitrary code via a crafted
MKV file, possibly involving an integer overflow and out-of-bounds read or
heap-based buffer overflow, or an uncaught exception. NOTE: the vendor
disputes the severity and claimed vulnerability type of this issue, stating
βThis PoC crashes VLC, indeed, but does nothing moreβ¦ this is not an
integer overflow error, but an uncaught exception and I doubt that it is
exploitable. This uncaught exception makes VLC abort, not execute random
code, on my Linux 64bits machine.β A PoC posted by the original researcher
shows signs of an attacker-controlled out-of-bounds read, but the affected
instruction does not involve a register that directly influences control
flow.
git.videolan.org/?p=vlc.git;a=commit;h=59c9e8309d5b435a2d85c2c9eaae979ba56ccdd9
seclists.org/fulldisclosure/2013/Jul/71
seclists.org/fulldisclosure/2013/Jul/77
seclists.org/fulldisclosure/2013/Jul/79
secunia.com/advisories/52956
secunia.com/blog/372/
www.jbkempf.com/blog/post/2013/More-lies-from-Secunia
launchpad.net/bugs/cve/CVE-2013-3245
nvd.nist.gov/vuln/detail/CVE-2013-3245
security-tracker.debian.org/tracker/CVE-2013-3245
www.cve.org/CVERecord?id=CVE-2013-3245
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
EPSS
Percentile
81.9%