Check Point posted to their blog about maliciously crafted subtitles being used to exploit players vulnerable to (I’m assuming) buffer overflows. While Plex isn’t specifically listed, Kodi, VLC, Popcorn Time, and strem.io are. Can we get an official comment on this? They haven’t posted technical …

@trexid said: Came here to post this exact thread. Glad there are already security focused users asking the right questions. I’m going to see if there is any discussion over at https://forum.opensubtitles.org/ about this since that is the primary source for Plex subs right? Source: https://suppor…

Sine Plex is a spinoff of Kodi I expect it to be vulnerable in the same way.

@Nebula said: Sine Plex is a spinoff of Kodi I expect it to be vulnerable in the same way. Outdated information. There is nothing from Kodi in Plex. The last thing was ‘Plex HomeTheater’, which was Kodi-based. @maik I wish we had more details about the actual exploit (where they showed MSF b…

@maik said: I want to take the dev’s word for it, but there are very few details. Was it the special characters in the filename causing the exploit itself in the client media players? Or was that just how they manipulated their subtitles files to be at the top of the search results? I wish we h…

@OttoKerner said: @Nebula said: Sine Plex is a spinoff of Kodi I expect it to be vulnerable in the same way. Outdated information. There is nothing from Kodi in Plex. The last thing was ‘Plex HomeTheater’, which was Kodi-based. Good to know, thanks!

im also curious to see if Plex is affected by this.

Hello, I came here for the same purpose. I found this thread in the Kodi github. If this can help :smile: (I’m not a programmation expert) [filesystem] ZipManager: skip path traversal xbmc:Krypton ← Rechi:zipTraversalKrypton …

I hope the Linux based servers are safe, since the ‘plex’ user is severely limited, but I really don’t wanna see my server shredded one day…

Understand details about vuln are not yet public, but what’s the word from Plex headquarter? Is Plex affected by this or not?

Are Plex players vulnerable to the subtitle processing vulnerabilities reported by Check Point?

General Discussions

BigWheel May 25, 2017, 3:20am 17

we are checking things. there are lots of things to check

Topic		Replies	Views
Is Plex vulnerable to malformed subtitles? General Discussions	2	66	January 7, 2020
Is Plex vulnerable to this subtitle file hack? Dev/API Corner scanner-agent-dev	2	284	January 8, 2020
Subtitle Vulnerability General Discussions	2	49	January 7, 2020
Plex is not affected by "subtitle vulnerabilities" noted by Checkpoint Announcements service-announcements	0	928	May 25, 2017
Subtitle Security Vulnerability General Discussions	3	48	January 7, 2020

Are Plex players vulnerable to the subtitle processing vulnerabilities reported by Check Point?

Related topics