PT-2019-3290 · Videolan+3 · Vlc Media Player+3

Published 2019-06-11 · Updated 2019-08-26 · CVE-2019-12874

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VideoLAN VLC media player versions 3.x through 3.0.7

Description The issue is related to the Matroska demuxer in the VideoLAN VLC media player, which has a double free error when parsing a malformed MKV file type. This can be exploited by a remote attacker to access confidential data, compromise data integrity, and cause a denial of service.

Recommendations For VideoLAN VLC media player versions 3.x through 3.0.7, consider updating to a version that fixes the issue in the zlib decompress extra function as soon as it becomes available. As a temporary workaround, avoid using the Matroska demuxer to parse potentially malformed MKV files until a patch is available.

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

ALT-PU-2019-2067

ALT-PU-2019-2509

BDU:2019-03342

CVE-2019-12874

DSA-4459-1

OPENSUSE-SU-2019:1840-1

OPENSUSE-SU-2019:1897-1

OPENSUSE-SU-2019:1909-1

OPENSUSE-SU-2019:2015-1

OPENSUSE-SU-2019_1840-1

OPENSUSE-SU-2019_1909-1

USN-4074-1

Affected Products

Alt Linux

Suse

Ubuntu

Vlc Media Player

References · 79

• https://usn.ubuntu.com/4074-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13962 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12874 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-12874 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5439 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-12874 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12874 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00037.html · Vendor Advisory
• https://security.gentoo.org/glsa/201908-23 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13602 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2019:1897-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5460 · Security Note
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=41192827 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02879 · Security Note
• https://ubuntu.com/security/CVE-2019-5439 · Vendor Advisory