CVE-2014-10024 - Multiple integer signedness errors in DirectShowDemuxFilter, as used in Divx Web Player, Divx Player, and other Divx plugins, allow remote attackers to execute arbitrary code via a (1) negative or (2) large value in a Stream Format (STRF) chunk in an AVI file, which triggers a heap-based buffer overflow

Back Back to CVE browser

HIGH

Multiple integer signedness errors in DirectShowDemuxFilter, as used in Divx Web Player, Divx Player, and other Divx plugins, allow remote attackers to execute arbitrary code via a (1) negative or (2) large value in a Stream Format (STRF) chunk in an AVI file, which triggers a heap-based buffer overflow

Published Jan 13, 2015

7.5

HIGH

CVSS 2.0

EPSS 2.96%

Description

Multiple integer signedness errors in DirectShowDemuxFilter, as used in Divx Web Player, Divx Player, and other Divx plugins, allow remote attackers to execute arbitrary code via a (1) negative or (2) large value in a Stream Format (STRF) chunk in an AVI file, which triggers a heap-based buffer overflow.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-189

References (3)

http://seclists.org/fulldisclosure/2014/Apr/283
mailing-listx_refsource_FULLDISCExploit
http://www.securityfocus.com/bid/67086
vdb-entryx_refsource_BID
https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-1096
Advisory

Link	Providers	Tags
http://seclists.org/fulldisclosure/2014/Apr/283		mailing-listx_refsource_FULLDISCExploit
http://www.securityfocus.com/bid/67086		vdb-entryx_refsource_BID
https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-1096		Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jan 13, 2015

Updated Sep 17, 2024

Reserved Jan 13, 2015

Link CVE-2014-10024

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2014-10024

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Jan 13, 2015

Updated Sep 17, 2024

Link EUVD-2014-1096

GitHub

No data