CVE-2007-6683
The browser plugin in VideoLAN VLC 0.8.6d allows remote attackers to overwrite arbitrary files...
The browser plugin in VideoLAN VLC 0.8.6d allows remote attackers to overwrite arbitrary files via (1) the :demuxdump-file option in a filename in a playlist, or (2) a EXTVLCOPT statement in an MP3 file, possibly an argument injection vulnerability.
Exploit likelihood
What each source reports
NVD Score used
The browser plugin in VideoLAN VLC 0.8.6d allows remote attackers to overwrite arbitrary files via (1) the :demuxdump-file option in a filename in a playlist, or (2) a EXTVLCOPT statement in an MP3 file, possibly an argument injection vulnerability.
- Record
CVE-2007-6683- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
The browser plugin in VideoLAN VLC 0.8.6d allows remote attackers to overwrite arbitrary files via (1) the :demuxdump-file option in a filename in a playlist, or (2) a EXTVLCOPT statement in an MP3 file, possibly an argument injection vulnerability.
- Record
CVE-2007-6683- Updated
- 2026-11-02
EUVDEUVD-2007-6647 No score
The browser plugin in VideoLAN VLC 0.8.6d allows remote attackers to overwrite arbitrary files via (1) the :demuxdump-file option in a filename in a playlist, or (2) a EXTVLCOPT statement in an MP3 file, possibly an argument injection vulnerability.
- Record
EUVD-2007-6647- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v5fx-4grc-7jmr No score
The browser plugin in VideoLAN VLC 0.8.6d allows remote attackers to overwrite arbitrary files...
The browser plugin in VideoLAN VLC 0.8.6d allows remote attackers to overwrite arbitrary files via (1) the :demuxdump-file option in a filename in a playlist, or (2) a EXTVLCOPT statement in an MP3 file, possibly an argument injection vulnerability.
- Record
GHSA-v5fx-4grc-7jmr- Updated
- 2026-11-02
OSV No score
The browser plugin in VideoLAN VLC 0.8.6d allows remote attackers to overwrite arbitrary files via (1) the :demuxdump-file option in a filename in a playlist, or (2) a EXTVLCOPT statement in an MP3 file, possibly an argument injection vulnerability.
- Record
CVE-2007-6683- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-6683 No score
The browser plugin in VideoLAN VLC 0.8.6d allows remote attackers to overwrite arbitrary files via (1) the :demuxdump-file option in a filename in a playlist, or (2) a EXTVLCOPT statement in an MP3 file, possibly an argument injection vulnerability.
- Record
DEBIAN-CVE-2007-6683- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vlcDebian:12 |
before 0.8.6.c-4.1 | 0.8.6.c-4.1 |
vlcDebian:13 |
before 0.8.6.c-4.1 | 0.8.6.c-4.1 |
vlcDebian:14 |
before 0.8.6.c-4.1 | 0.8.6.c-4.1 |
vlcDebian:4.0 |
before 0.8.6-svn20061012.debian-5.1+etch2, plus listed versions 0.8.6-svn20061012.debian-50.8.6-svn20061012.debian-5etch1 |
0.8.6-svn20061012.debian-5.1+etch2 |
vlcDebian:5.0 |
before 0.8.6.c-6+lenny5 | 0.8.6.c-6+lenny5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| aliases | ||
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-6683 is a medium vulnerability (CVSS 5.0) in Videolan Vlc, published January 17, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.78%, the 86th percentile. Fixed in vlc 0.8.6.c-4.1.
References
securityfocus.com/bid/28712
secunia.com/advisories/29284
osvdb.org/42205
debian.org/security/2008/dsa-1543
mailman.videolan.org/pipermail/vlc-devel/2007-December/037726.html
Show 8 moreShow less
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14619
trac.videolan.org/vlc/ticket/1371
gentoo.org/security/en/glsa/glsa-200803-13.xml
nvd.nist.gov/vuln/detail/CVE-2007-6683
github.com/advisories/GHSA-v5fx-4grc-7jmr
security-tracker.debian.org/tracker/CVE-2007-6683