This update for vlc to version 3.0.7.1 fixes the following issues :

Security issues fixed :

  - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354).

  - CVE-2019-5459: Fixed an integer underflow (bsc#1143549).

  - CVE-2019-5460: Fixed a double free (bsc#1143547).

  - CVE-2019-12874: Fixed a double free in     zlib_decompress_extra in modules/demux/mkv/util.cpp     (bsc#1138933).

  - CVE-2019-13602: Fixed an integer underflow in mp4     demuxer (boo#1141522).

  - CVE-2019-13962: Fixed a heap-based buffer over-read in     avcodec (boo#1142161).

Non-security issues fixed :

  - Video Output :

  - Fix hardware acceleration with some AMD drivers

  - Improve direct3d11 HDR support

  - Access :

  - Improve Blu-ray support

  - Audio output :

  - Fix pass-through on Android-23

  - Fix DirectSound drain

  - Demux: Improve MP4 support

  - Video Output :

  - Fix 12 bits sources playback with Direct3D11

  - Fix crash on iOS

  - Fix midstream aspect-ratio changes when Windows hardware     decoding is on

  - Fix HLG display with Direct3D11

  - Stream Output: Improve Chromecast support with new     ChromeCast apps

  - Misc :

  - Update Youtube, Dailymotion, Vimeo, Soundcloud scripts

  - Work around busy looping when playing an invalid item     with loop enabled

  - Updated translations.

New package libaom :

  - Initial version 1.0.0

  - A library for AOMedia Video 1 (AV1), an open,     royalty-free video coding format designed for video     transmissions over the Internet.

It was discovered that the VLC CAF demuxer incorrectly handled certain files. If a user were tricked into opening a specially crafted CAF file, a remote attacker could use this issue to cause VLC to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-19857)

It was discovered that the VLC Matroska demuxer incorrectly handled certain files. If a user were tricked into opening a specially crafted MKV file, a remote attacker could use this issue to cause VLC to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-12874)

It was discovered that the VLC MP4 demuxer incorrectly handled certain files. If a user were tricked into opening a specially crafted MP4 file, a remote attacker could use this issue to cause VLC to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2019-13602)

It was discovered that the VLC AVI demuxer incorrectly handled certain files. If a user were tricked into opening a specially crafted AVI file, a remote attacker could use this issue to cause VLC to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2019-5439).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

zhangyang reports :

The ReadFrame function in the avi.c file uses a variable i_width_bytes, which is obtained directly from the file. It is a signed integer. It does not do a strict check before the memory operation(memmove, memcpy), which may cause a buffer overflow.

The remote host is affected by the vulnerability described in GLSA-201908-23 (VLC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VLC. Please review the       CVE identifiers referenced below for details.
  Impact :

    Remote attackers, by enticing a user to execute a specially crafted       media file, could cause a Denial of Service condition or possibly execute       arbitrary code.
  Workaround :

    There is no known workaround at this time.

This update for vlc to version 3.0.7.1 fixes the following issues :

Security issues fixed :

&#9; - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354).

  - CVE-2019-5459: Fixed an integer underflow (bsc#1143549).

  - CVE-2019-5460: Fixed a double free (bsc#1143547).

  - CVE-2019-12874: Fixed a double free in     zlib_decompress_extra in modules/demux/mkv/util.cpp     (bsc#1138933).

  - CVE-2019-13602: Fixed an integer underflow in mp4     demuxer (boo#1141522).

  - CVE-2019-13962: Fixed a heap-based buffer over-read in     avcodec (boo#1142161).

Non-security issues fixed :

  - Video Output :

  - Fix hardware acceleration with some AMD drivers

  - Improve direct3d11 HDR support

  - Access :

  - Improve Blu-ray support

  - Audio output :

  - Fix pass-through on Android-23

  - Fix DirectSound drain

  - Demux: Improve MP4 support

  - Video Output :

  - Fix 12 bits sources playback with Direct3D11

  - Fix crash on iOS

  - Fix midstream aspect-ratio changes when Windows hardware     decoding is on

  - Fix HLG display with Direct3D11

  - Stream Output: Improve Chromecast support with new     ChromeCast apps

  - Misc :

  - Update Youtube, Dailymotion, Vimeo, Soundcloud scripts

  - Work around busy looping when playing an invalid item     with loop enabled

  - Updated translations.

The version of VLC media player installed on the remote host is earlier than 3.0.7.  It is, therefore, affected by multiple vulnerabilities:

  - A heap-based buffer overflow condition exists in ReadFrame     due to improper parsing of AVI files. A remote attacker can     exploit this by tricking a user into opening a specially     crafted avi file to cause a denial of service condition     or the execution of arbitrary code.(CVE-2019-5439)

  - A double free vulnerability exists in zlib_decompress_extra     due to improper parsing of MKV files. A remote attacker can     exploit this by tricking a user into opening a specially     crafted MKV file to cause a denial of service condition     or the execution of arbitrary code.(CVE-2019-12874)

  - An Integer underflow in VLC Media Player versions < 3.0.7     leads to an out-of-band read..(CVE-2019-5459)

  - A double free vulnerability exists which lead to VLC application to crash.
    (CVE-2019-5460)

ID	Name	Product	Family	Published	Updated	Severity
128001	openSUSE Security Update : vlc (openSUSE-2019-1909)	Nessus	SuSE Local Security Checks	8/20/2019	5/2/2024	critical
127095	Ubuntu 18.04 LTS : VLC vulnerabilities (USN-4074-1)	Nessus	Ubuntu Local Security Checks	7/26/2019	10/20/2023	critical
126082	FreeBSD : vlc -- Buffer overflow vulnerability (f2144530-936f-11e9-8fc4-5404a68ad561)	Nessus	FreeBSD Local Security Checks	6/21/2019	5/15/2024	medium
127972	GLSA-201908-23 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	8/20/2019	5/2/2024	critical
127743	openSUSE Security Update : vlc (openSUSE-2019-1840)	Nessus	SuSE Local Security Checks	8/12/2019	5/6/2024	critical
126246	VLC < 3.0.7 Multiple Vulnerabilities	Nessus	Windows	6/25/2019	5/14/2024	critical

Detections

Analytics

Plugins Search

critical

critical

medium

critical

critical

critical