CVE-2010-2937 json
The ReadMetaFromId3v2 function in taglib.cpp in the TagLib plugin in VideoLAN VLC media player 0.9.0 through 1.1.2 does not properly proces…
published 2010-08-20 16 y ago modified 2026-06-16 4 mo ago also EUVD-2010-2941
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.6%
- EPSS 2.6% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known
Summary
The ReadMetaFromId3v2 function in taglib.cpp in the TagLib plugin in VideoLAN VLC media player 0.9.0 through 1.1.2 does not properly process ID3v2 tags, which allows remote attackers to cause a denial of service (application crash) via a crafted media file.
Patch / fix
- vlc Debian 14, Debian 13, Debian 12 1.1.3-1
debian advisories DEBIAN-CVE-2010-2937
- vlc openSUSE Tumbleweed 2.2.4-11.1
opensuse advisories openSUSE-SU-2024:10064-1
Exploit prediction
2.64% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
videolan.org
/security/sa1004.html
vendor-advisory
- git.videolan.org /?p=vlc/vlc-1.0.git%3Ba=commit%3Bh=22a22e356c9d93993086810b2e25b59b55925b3a
- git.videolan.org /?p=vlc/vlc-1.1.git%3Ba=commit%3Bh=24918843e57c7962e28fcb01845adce82bed6516
-
securityfocus.com
/bid/42386
vdb-entry
-
vupen.com
/english/advisories/2010/2087
vdb-entry
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14676
vdb-entry, signature
Sources
- CVE List CVE-2010-2937
- NVD CVE-2010-2937
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.