CVE-2015-5949
VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and...
VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file, which triggers the freeing of arbitrary pointers.
Exploit likelihood
What each source reports
NVD Score used
VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file, which triggers the freeing of arbitrary pointers.
- Record
CVE-2015-5949- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file, which triggers the freeing of arbitrary pointers.
- Record
CVE-2015-5949- Updated
- 2026-11-02
EUVDEUVD-2015-5895 No score
VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file, which triggers the freeing of arbitrary pointers.
- Record
EUVD-2015-5895- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jvqc-5hhq-rvwf No score
VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and...
VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file, which triggers the freeing of arbitrary pointers.
- Record
GHSA-jvqc-5hhq-rvwf- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file, which triggers the freeing of arbitrary pointers.
- Record
CVE-2015-5949- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-5949 No score
VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file, which triggers the freeing of arbitrary pointers.
- Record
DEBIAN-CVE-2015-5949- Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2015-0324 No score
Updated vlc packages fix security vulnerability
Loren Maggiore of Trail of Bits discovered that the 3GP parser of VLC, a multimedia player and streamer, could dereference an arbitrary pointer due to insufficient restrictions on a writable buffer. This could allow remote attackers to execute arbitrary code via crafted 3GP files (CVE-2015-5949).
- Record
MGASA-2015-0324- Updated
- 2026-11-02
OSVMGASA-2015-0329 No score
Updated vlc packages fix security vulnerabilities
Loren Maggiore of Trail of Bits discovered that the 3GP parser of VLC, a multimedia player and streamer, could dereference an arbitrary pointer due to insufficient restrictions on a writable buffer. This could allow remote attackers to execute arbitrary code via crafted 3GP files (CVE-2015-5949).
- Record
MGASA-2015-0329- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10064-1 No score
libvlc5-2.2.4-11.1 on GA media
These are all security issues fixed in the libvlc5-2.2.4-11.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10064-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-5949 No score
VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file, which triggers the freeing of arbitrary pointers.
- Record
UBUNTU-CVE-2015-5949- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vlcDebian:12 |
before 2.2.1-3 | 2.2.1-3 |
vlcDebian:13 |
before 2.2.1-3 | 2.2.1-3 |
vlcDebian:14 |
before 2.2.1-3 | 2.2.1-3 |
vlcDebian:8 |
before 2.2.0~rc2-2+deb8u1, plus listed versions 2.2.0~rc2-2 |
2.2.0~rc2-2+deb8u1 |
vlcMageia:5 |
before 2.2.1-1.1.mga5 | 2.2.1-1.1.mga5 |
vlcMageia:5 |
before 2.2.1-1.1.mga5.tainted | 2.2.1-1.1.mga5.tainted |
vlcMageia:4 |
before 2.1.6-1.1.mga4 | 2.1.6-1.1.mga4 |
vlcMageia:4 |
before 2.1.6-1.1.mga4.tainted | 2.1.6-1.1.mga4.tainted |
vlcopenSUSE:Tumbleweed From an advisory covering 9 CVEs |
before 2.2.4-11.1 | 2.2.4-11.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-5949 is a medium vulnerability (CVSS 6.8) in Videolan Vlc Media Player, published August 20, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 13.3%, the 96th percentile. Fixed in vlc 2.2.1-3.
References
git.videolan.org?p=vlc/vlc-2.2.git%3Ba=commitdiff%3Bh=ce91452460a75d7424b165c4dc8db98114c3cbd9%3Bhp=9e12195d3e4316278af1fa4bcb6a705ff27456fd
debian.org/security/2015/dsa-3342
security.gentoo.org/glsa/201603-08
openwall.com/lists/oss-security/2015/08/20/8
securityfocus.com/archive/1/536287/100/0/threaded
ocert.org/advisories/ocert-2015-009.html
Show 23 moreShow less
lists.opensuse.org/opensuse-security-announce/2016-02/msg00040.html
packetstormsecurity.com/files/133266/VLC-2.2.1-Arbitrary-Pointer-Dereference.html
nvd.nist.gov/vuln/detail/CVE-2015-5949
github.com/advisories/GHSA-jvqc-5hhq-rvwf
security-tracker.debian.org/tracker/CVE-2015-5949
advisories.mageia.org/MGASA-2015-0324.html
bugs.mageia.org/show_bug.cgi?id=16623
lists.debian.org/debian-security-announce/2015/msg00241.html
ubuntu.com/security/CVE-2015-5949
cve.org/CVERecord?id=CVE-2015-5949
suse.com/security/cve/CVE-2010-2937