libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a
    heap-based buffer over-read in EbmlElement::FindNextElement. (CVE-2019-13615)

TThe version of VLC media player installed on the remote host is prior to 3.0.3. It is, therefore, affected by a heap-based buffer overflow vulnerability in its 'EbmlElement::FindNextElement' component. An unauthenticated, local attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2019-13615).

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4073-1 advisory.

    It was discovered that libEBML incorrectly handled certain media files. If a user were tricked into     opening a specially crafted media file, libEBML could possibly be made to crash, resulting in a denial of     service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
405151	Alpine: multiple libebml packages: security update to 1.3.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
405151	Alpine: multiple libebml packages: security update to 1.3.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
405150	Alpine: multiple libebml packages: security update to 1.3.5-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
405150	Alpine: multiple libebml packages: security update to 1.3.5-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
136999	VLC < 3.0.3 Heap Based Buffer Overflow Vulnerability	Nessus	Windows	medium
127094	Ubuntu 16.04 LTS / 18.04 LTS : libEBML vulnerability (USN-4073-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2019-13615

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium