CVE-2017-17670

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules/demux/mp4/libmp4.c in the MP4 demux module leading to a invalid free, because the type of a box may be changed between a read operation and a free operation.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://openwall.com/lists/oss-security/2017/12/15/1Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/102214Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040938Third Party Advisory, VDB Entry
https://www.debian.org/security/2018/dsa-4203Third Party Advisory
http://openwall.com/lists/oss-security/2017/12/15/1Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/102214Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040938Third Party Advisory, VDB Entry
https://www.debian.org/security/2018/dsa-4203Third Party Advisory

Timeline

Published: Dec 15, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-176719.8vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request CVE-2017-176729.8In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certa CVE-2017-176749.8BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the syst CVE-2017-176755.3BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allowing for an attacker t CVE-2017-176778.8BMC Remedy 9.1SP3 is affected by authenticated code execution. Authenticated users that have the right to create reports can use BIRT templa CVE-2017-176786.1BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripting (XSS). A DOM-based cross-site scripting vulnerability was discovered in a leg CVE-2017-17684.3IBM Security Guardium Big Data Intelligence (SonarG) 3.1 generates an error message that includes sensitive information about its environmen CVE-2017-176806.5In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadXPMImage in coders/xpm.c, which allows attackers to c CVE-2017-176816.5In ImageMagick 7.0.7-12 Q16, an infinite loop vulnerability was found in the function ReadPSDChannelZip in coders/psd.c, which allows attack CVE-2017-176826.5In ImageMagick 7.0.7-12 Q16, a large loop vulnerability was found in the function ExtractPostscript in coders/wpg.c, which allows attackers CVE-2017-176837.5Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c44 \\.\PSMEMDriver DeviceIoControl request.CVE-2017-176847.5Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c04 \\.\PSMEMDriver DeviceIoControl request.