Libdvdnav
Monthly
Opening a crafted DVD or disc image in a media player built on VideoLAN libdvdnav through 7.0.0 can crash the application through an out-of-bounds read in DVD navigation handling. The fault is triggered when the disc's First Play program chain issues a JumpTT command with title 0 or an oversized title number, causing the library to index past its heap title table because validation relies on an assert rather than a runtime bounds check. Exploitation requires local delivery and user playback of the malicious media, no public exploit was identified at time of analysis, and the assessed impact is denial of service only.
Opening a crafted DVD or disc image in applications that use libdvdnav before 7.0.0 can trigger a heap out-of-bounds read during chapter enumeration and crash the application. The attacker supplies media whose VMGI title declares a vts_ttn larger than the corresponding title set's part-of-title entries; exploitation is local and requires the victim to open the crafted media, and only availability is affected. No public exploit has been identified at time of analysis, and the vendor has released a patch.
Opening a crafted DVD or disc image in a media player built on VideoLAN libdvdnav through 7.0.0 can crash the application through an out-of-bounds read in DVD navigation handling. The fault is triggered when the disc's First Play program chain issues a JumpTT command with title 0 or an oversized title number, causing the library to index past its heap title table because validation relies on an assert rather than a runtime bounds check. Exploitation requires local delivery and user playback of the malicious media, no public exploit was identified at time of analysis, and the assessed impact is denial of service only.
Opening a crafted DVD or disc image in applications that use libdvdnav before 7.0.0 can trigger a heap out-of-bounds read during chapter enumeration and crash the application. The attacker supplies media whose VMGI title declares a vts_ttn larger than the corresponding title set's part-of-title entries; exploitation is local and requires the victim to open the crafted media, and only availability is affected. No public exploit has been identified at time of analysis, and the vendor has released a patch.