CVE-2007-0017

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-01-03 · updated 2026-06-16
Weakness: CWE-134

Description

Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an invalid URI, as demonstrated by a udp://-- URI in an M3U file.

Affected products

VideoLAN VLC: 0.7.0, 0.7.1, 0.7.2, 0.8.0, 0.8.1, 0.8.2 (+4)

References

http://applefun.blogspot.com/2007/01/moab-02-01-2007-vlc-media-player-udp.html
http://landonf.bikemonkey.org/code/macosx/MOAB_Day_2.20070103045559.6753.timor.html
http://osvdb.org/31163
http://projects.info-pull.com/moab/MOAB-02-01-2007.html
http://secunia.com/advisories/23592
http://secunia.com/advisories/23829
http://secunia.com/advisories/23910
http://secunia.com/advisories/23971
http://security.gentoo.org/glsa/glsa-200701-24.xml
http://securitytracker.com/id?1017464
http://trac.videolan.org/vlc/changeset/18481
http://www.debian.org/security/2007/dsa-1252

Get alerted when CVE-2007-0017 or the next vulnerability affects your stack