CVE-2008-5036

NameCVE-2008-5036
DescriptionStack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an invalid RealText (rt) subtitle file, related to the ParseRealText function in modules/demux/subtitle.c. NOTE: this issue was SPLIT from CVE-2008-5032 on 20081110.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
vlc (PTS)bullseye (security), bullseye3.0.21-0+deb11u1fixed
bookworm, bookworm (security)3.0.21-0+deb12u1fixed
trixie3.0.21-10fixed
forky, sid3.0.22~rc1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
vlcsourceetch(not affected)
vlcsourcelenny(not affected)
vlcsource(unstable)1.0.3-1low

Notes

[etch] - vlc <not-affected> (Vulnerable code not present in 0.8.x)
[lenny] - vlc <not-affected> (Vulnerable code not present in 0.8.x)
Search for package or bug name: Reporting problems