PT-2019-3460 · Videolan+3 · Vlc Media Player+3

Antonio Morales

·

Publicado

2019-08-14

·

Atualizado

2024-06-15

·

CVE-2019-14776

CVSS v3.1

7.8

Alta

VetorAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions VideoLAN VLC media player version 3.0.7.1
Description A heap-based buffer over-read exists in the DemuxInit() function in the VideoLAN VLC media player, which can be exploited via a crafted .mkv file. This issue may allow a remote attacker to impact data integrity, gain unauthorized access to protected information, and cause a denial of service.
Recommendations For version 3.0.7.1, consider disabling the DemuxInit() function until a patch is available to prevent potential exploitation. Restrict access to .mkv files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

ALT-PU-2019-2483
BDU:2019-03634
CVE-2019-14776
DSA-4504-1
MGASA-2019-0233
OPENSUSE-SU-2020:0545-1
OPENSUSE-SU-2020:0562-1
OPENSUSE-SU-2020_0545-1
OPENSUSE-SU-2024:11502-1
USN-4131-1

Produtos afetados

Alt Linux
Suse
Ubuntu
Vlc Media Player