CVE-2014-6440

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

VideoLAN VLC media player before 2.1.5 allows remote attackers to execute arbitrary code or cause a denial of service.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://billblough.net/blog/2015/03/04/cve-2014-6440-heap-overflow-in-vlc-transcode-module/Exploit, Patch, Technical Description, Third Party Advisory
http://seclists.org/oss-sec/2015/q1/751Patch, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/72950Third Party Advisory, VDB Entry
http://www.videolan.org/developers/vlc-branch/NEWSRelease Notes, Vendor Advisory
https://security.gentoo.org/glsa/201603-08Third Party Advisory, VDB Entry
http://billblough.net/blog/2015/03/04/cve-2014-6440-heap-overflow-in-vlc-transcode-module/Exploit, Patch, Technical Description, Third Party Advisory
http://seclists.org/oss-sec/2015/q1/751Patch, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/72950Third Party Advisory, VDB Entry
http://www.videolan.org/developers/vlc-branch/NEWSRelease Notes, Vendor Advisory
https://security.gentoo.org/glsa/201603-08Third Party Advisory, VDB Entry

Timeline

Published: Mar 28, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-64446.1Multiple cross-site scripting (XSS) vulnerabilities in the Titan Framework plugin before 1.6 for WordPress allow remote attackers to inject CVE-2014-64454.3Multiple cross-site scripting (XSS) vulnerabilities in includes/toAdmin.php in Contact Form 7 Integrations plugin 1.0 through 1.3.10 for Wor CVE-2014-64467.5The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to CVE-2014-64477.1Multiple vulnerabilities exist in Juniper Junos J-Web error handling that may lead to cross site scripting (XSS) issues or crash the J-Web s CVE-2014-64487.8Juniper Junos OS 13.2 before 13.2R5, 13.2X51, 13.2X52, and 13.3 before 13.3R3 allow local users to bypass intended restrictions and execute CVE-2014-64495.0Juniper Junos OS before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D15 CVE-2014-64507.8Juniper Junos OS before 11.4R12-S4, 12.1X44 before 12.1X44-D41, 12.1X46 before 12.1X46-D26, 12.1X47 before 12.1X47-D11/D15, 12.2 before 12.2 CVE-2014-64517.8J-Web in Juniper vSRX virtual firewalls with Junos OS before 15.1X49-D20 allows remote attackers to cause a denial of service (system reboot CVE-2014-64524.0Unspecified vulnerability in the SQLJ component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote CVE-2014-64539.0Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows rem CVE-2014-64544.0Unspecified vulnerability in the SQLJ component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote CVE-2014-64559.0Unspecified vulnerability in the SQLJ component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote