CVE-2008-4686

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Multiple integer overflows in ty.c in the TY demux plugin (aka the TiVo demuxer) in VideoLAN VLC media player, probably 0.9.4, might allow remote attackers to execute arbitrary code via a crafted .ty file, a different vulnerability than CVE-2008-4654.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-189

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Oct 22, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-46879.0manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP CVE-2008-46885.0core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source CVE-2008-46897.5Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attackers to hijack sessions.CVE-2008-469010.0lynx 2.8.6dev.15 and earlier, when advanced mode is enabled and lynx is configured as a URL handler, allows remote attackers to execute arbi CVE-2008-46915.0Unspecified vulnerability in the SQLNLS_UNPADDEDCHARLEN function in the New Compiler (aka Starburst derived compiler) component in the serve CVE-2008-469210.0The Native Managed Provider for .NET component in IBM DB2 8 before FP17, 9.1 before FP6, and 9.5 before FP2, when a definer cannot maintain CVE-2008-46935.0The SORT/LIST SERVICES component in IBM DB2 9.1 before FP6 and 9.5 before FP2 writes sensitive information to the trace output, which allows CVE-2008-46949.3Unspecified vulnerability in Opera before 9.60 allows remote attackers to cause a denial of service (application crash) or execute arbitrary CVE-2008-46959.3Opera before 9.60 allows remote attackers to obtain sensitive information and have unspecified other impact by predicting the cache pathname CVE-2008-46964.3Cross-site scripting (XSS) vulnerability in Opera.dll in Opera before 9.61 allows remote attackers to inject arbitrary web script or HTML vi CVE-2008-46974.3The Fast Forward feature in Opera before 9.61, when a page is located in a frame, executes a javascript: URL in the context of the outermost CVE-2008-46985.8Opera before 9.61 does not properly block scripts during preview of a news feed, which allows remote attackers to create arbitrary new feed