PT-2020-2142 · Sdl+4 · Sdl Image+4

Published 2020-04-23 · Updated 2023-06-20 · CVE-2019-19721

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VideoLAN VLC media player versions prior to 3.0.9

Description The issue is related to an off-by-one error in the DecodeBlock function in codec/sdl image.c, which allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. This may be related to the SDL Image product. The vulnerability can be exploited by a remote attacker using a specially crafted request, potentially leading to a denial of service or arbitrary code execution.

Recommendations For versions prior to 3.0.9, update to version 3.0.9 or later to resolve the issue. As a temporary workaround, consider disabling the DecodeBlock function in codec/sdl image.c until a patch is available. Restrict access to crafted image files to minimize the risk of exploitation.

Exploit

Fix

DoS

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-193

CWE-119

CWE-787

Related Identifiers

ALT-PU-2020-1848

ALT-PU-2020-2203

BDU:2020-02046

CVE-2019-19721

DSA-4671-1

MGASA-2020-0203

USN-6180-1

Affected Products

Alt Linux

Linuxmint

Sdl Image

Ubuntu

Vlc Media Player

References · 32

• 🔥 https://bugs.gentoo.org/721940 · Exploit
• https://cve.org/CVERecord?id=CVE-2019-19721 · Security Note
• https://ubuntu.com/security/notices/USN-6180-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02046 · Security Note
• https://ubuntu.com/security/CVE-2020-13428 · Vendor Advisory
• https://videolan.org/security · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-25803 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4671-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-25804 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0203.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-19721 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-25801 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0203 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19721 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-25802 · Vendor Advisory