{"id":"CVE-2008-0984","aliases":["DEBIAN-CVE-2008-0984","DSA-1543-1","DTSA-116-1","EUVD-2008-0991","GHSA-g9w3-mq78-c86r"],"status":"published","title":"The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and...","description":"The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file.","severity":{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.15284,"percentile":0.9679,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-399"],"published":"2008-02-26T19:00:00Z","modified":"2026-10-23T17:47:35Z","exploits":[{"source":"exploitdb","id":"EDB-5498","title":"Kantaris 0.3.4 - SSA Subtitle Local Buffer Overflow","type":"local","platform":"windows","date":"2008-04-25","verified":true,"url":"https://www.exploit-db.com/exploits/5498"}],"fixes":[{"ecosystem":"Debian:12","package":"vlc","fixed_in":["0.8.6.e-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vlc","fixed_in":["0.8.6.e-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vlc","fixed_in":["0.8.6.e-1"],"sources":["osv"]},{"ecosystem":"Debian:5.0","package":"vlc","fixed_in":["0.8.6.c-6+lenny1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.6.e-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.6.e-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.6.e-1"}]}]},{"source":"osv","ecosystem":"Debian:4.0","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.6-svn20061012.debian-5.1+etch2"}]}],"versions":["0.8.6-svn20061012.debian-5","0.8.6-svn20061012.debian-5etch1"],"bundled":8},{"source":"osv","ecosystem":"Debian:5.0","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.6.c-6+lenny1"}]}]}],"products":[{"vendor":"miro","product":"miro_player"},{"vendor":"videolan","product":"vlc_media_player"}],"references":[{"url":"http://secunia.com/advisories/29122","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/29284","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.debian.org/security/2008/dsa-1543","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/29153","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.videolan.org/security/sa0802.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://www.securityfocus.com/bid/28007","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.securitytracker.com/id?1019510","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060481.html","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"http://www.securityfocus.com/archive/1/488841/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://secunia.com/advisories/29766","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.vupen.com/english/advisories/2008/0682","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.coresecurity.com/?action=item\u0026id=2147","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200803-13.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-0984"},{"url":"https://github.com/advisories/GHSA-g9w3-mq78-c86r"},{"url":"https://security-tracker.debian.org/tracker/CVE-2008-0984","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2008-0984","description":"The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file.","status":"published","published":"2008-02-26T19:00:00Z","modified":"2024-08-07T08:01:40.12Z","updated_at":"2026-11-02T14:34:48.505097Z"}],"euvd":[{"id":"EUVD-2008-0991","description":"The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file.","status":"published","published":"2008-02-26T19:00:00Z","modified":"2024-08-07T08:01:40Z","updated_at":"2026-11-03T01:39:03.522798Z"}],"ghsa":[{"id":"GHSA-g9w3-mq78-c86r","title":"The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and...","description":"The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file.","status":"published","published":"2022-05-01T23:35:29Z","modified":"2023-01-31T05:05:34Z","updated_at":"2026-11-02T14:48:52.878887Z"}],"nvd":[{"id":"CVE-2008-0984","description":"The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file.","status":"published","published":"2008-02-26T19:44:00Z","modified":"2026-06-16T22:50:44.097Z","cvss":[{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:01:25.307768Z"}],"osv":[{"id":"CVE-2008-0984","description":"The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file.","status":"published","published":"2008-02-26T19:44:00Z","modified":"2026-04-10T03:39:40.543657Z","updated_at":"2026-11-02T15:43:57.178433Z"},{"id":"DEBIAN-CVE-2008-0984","description":"The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file.","status":"published","published":"2008-02-26T19:44:00Z","modified":"2026-10-23T17:47:35.256298543Z","updated_at":"2026-11-02T15:45:23.411908Z"},{"id":"DSA-1543-1","title":"vlc - several vulnerabilities","status":"published","published":"2008-04-09T00:00:00Z","modified":"2026-03-09T01:02:04.488111Z","updated_at":"2026-11-02T15:46:14.734124Z"},{"id":"DTSA-116-1","title":"vlc - arbitrary code execution","status":"published","published":"2008-02-28T00:00:00Z","modified":"2026-03-09T01:02:04.241484Z","updated_at":"2026-11-02T15:46:18.716547Z"}]}}