CVE-2017-8312

A vendor fix is available.

• FixedAbility Camera Connectabb_psirt

  The problem is corrected in the following product versions: ABB Ability Camera Connect 1.5.0.15 The 3rd party component has already been updated. The easiest path to mitigate the problem is an update of just VLC Media Player by the customer. ABB recommends that customers apply the update at earliest convenience. It is also possible to update to the latest Version of Camera Connect.

• FixedAbility Camera Connectcisa_csaf_ot

  The problem is corrected in the following product versions: ABB Ability Camera Connect 1.5.0.15 The 3rd party component has already been updated. The easiest path to mitigate the problem is an update of just VLC Media Player by the customer. ABB recommends that customers apply the update at earliest convenience. It is also possible to update to the latest Version of Camera Connect.

• MitigationAbility Camera Connectabb_psirt

  Because the affected VLC version (2.2.4) suffers from a heap out of bound read in the ParseJSS function—allowing an attacker to read uninitialized heap data via a crafted subtitles file—the risk of external exploitation is significantly reduced in your environment. Since the software is installed in strictly isolated systems with no internet access, no external attacker can deliver malicious subtitle files re-motely. Consequently, the only remaining exposure is local: an insider would need to intentionally load a crafted subtitle file to trigger the issue—a scenario considered highly unlikely under current governance and usage controls.

• MitigationAbility Camera Connectcisa_csaf_ot

  Because the affected VLC version (2.2.4) suffers from a heap out of bound read in the ParseJSS function—allowing an attacker to read uninitialized heap data via a crafted subtitles file—the risk of external exploitation is significantly reduced in your environment. Since the software is installed in strictly isolated systems with no internet access, no external attacker can deliver malicious subtitle files re-motely. Consequently, the only remaining exposure is local: an insider would need to intentionally load a crafted subtitle file to trigger the issue—a scenario considered highly unlikely under current governance and usage controls.