An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An exploitable code execution vulnerability exists in the label-parsing functionality of Videolabs
    libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the rr_decode function's return value
    is not checked, leading to a double free that could be exploited to execute arbitrary code. An attacker
    can send an mDNS message to trigger this vulnerability. (CVE-2020-6072)

  - An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before
    3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file.
    NOTE: this may be related to the SDL_Image product. (CVE-2019-19721)

  - An exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of
    Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the compression pointer is
    followed without checking for recursion, leading to a denial of service. An attacker can send an mDNS
    message to trigger this vulnerability. (CVE-2020-6071)

  - An exploitable denial-of-service vulnerability exists in the TXT record-parsing functionality of Videolabs
    libmicrodns 0.1.0. When parsing the RDATA section in a TXT record in mDNS messages, multiple integer
    overflows can be triggered, leading to a denial of service. An attacker can send an mDNS message to
    trigger this vulnerability. (CVE-2020-6073)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6180-1 advisory.

    It was discovered that VLC could be made to read out of bounds when decoding image files. If a user were     tricked into opening a crafted image file, a remote attacker could possibly use this issue to cause VLC to     crash, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
    (CVE-2019-19721)

    It was discovered that VLC could be made to write out of bounds when processing H.264 video files. If a     user were tricked into opening a crafted H.264 video file, a remote attacker could possibly use this issue     to cause VLC to crash, leading to a denial of service, or possibly execute arbitrary code. This issue only     affected Ubuntu 18.04 LTS and

    Ubuntu 20.04 LTS. (CVE-2020-13428)

    It was discovered that VLC could be made to read out of bounds when processing AVI video files. If a user     were tricked into opening a crafted AVI video file, a remote attacker could possibly use this issue to     cause VLC to crash, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu     18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-25801, CVE-2021-25802, CVE-2021-25803, CVE-2021-25804)

    It was discovered that the VNC module of VLC contained an arithmetic overflow. If a user were tricked into     opening a crafted playlist or connecting to a rouge VNC server, a remote attacker could possibly use this     issue to cause VLC to crash, leading to a denial of service, or possibly execute arbitrary code.
    (CVE-2022-41325)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202005-11 (VLC: Buffer overflow)

    A buffer overflow in DecodeBlock in sdl_image.c was discovered.
  Impact :

    A remote user could craft a specifically crafted image file that could       execute arbitrary code or cause denial of service.
  Workaround :

    The user should refrain from opening files from untrusted third parties       or accessing untrusted remote sites (or disable the VLC browser plugins),       until they upgrade.

The version of VLC media player installed on the remote Windows host is prior to 3.0.9. It is, therefore, affected by multiple vulnerabilities:

  - An exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of Videolabs     libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the compression pointer is followed without checking     for recursion, leading to a denial of service. An attacker can send an mDNS message to trigger this vulnerability     (CVE-2020-6071).     

  - An exploitable code execution vulnerability exists in the label-parsing functionality of Videolabs libmicrodns 0.1.0.     When parsing compressed labels in mDNS messages, the rr_decode function's return value is not checked, leading to a     double free that could be exploited to execute arbitrary code. An attacker can send an mDNS message to trigger this     vulnerability (CVE-2020-6072).

  - An exploitable denial-of-service vulnerability exists in the TXT record-parsing functionality of Videolabs libmicrodns 0.1.0.     When parsing the RDATA section in a TXT record in mDNS messages, multiple integer overflows can be triggered, leading to a denial     of service. An attacker can send an mDNS message to trigger this vulnerability (CVE-2020-6073).

  - An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0.     When parsing mDNS messages, the implementation does not properly keep track of the available data in the message, possibly leading     to an out-of-bounds read that would result in a denial of service. An attacker can send an mDNS message to trigger this     vulnerability (CVE-2020-6077).

  - An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0.     When parsing mDNS messages in mdns_recv, the return value of the mdns_read_header function is not checked, leading to an uninitialized     variable usage that eventually results in a null pointer dereference, leading to service crash. An attacker can send a series of     mDNS messages to trigger this vulnerability (CVE-2020-6078).

  - An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0.     When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service     condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger this vulnerability through decoding     of the domain name performed by rr_decode (CVE-2020-6079).

ID	Name	Product	Family	Severity
407539	Alpine: multiple vlc packages: security update to 3.0.9.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
407539	Alpine: multiple vlc packages: security update to 3.0.9.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
177459	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : VLC media player vulnerabilities (USN-6180-1)	Nessus	Ubuntu Local Security Checks	high
136641	GLSA-202005-11 : VLC: Buffer overflow	Nessus	Gentoo Local Security Checks	high
136422	VLC < 3.0.9 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2019-19721

high

Tenable Plugins

critical

critical

high

high

critical