PT-2020-2142 · Sdl+4 · Sdl Image+4
CVE-2019-19721
·
Published
2020-04-23
·
Updated
2023-06-20
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
VideoLAN VLC media player versions prior to 3.0.9
Description
The issue is related to an off-by-one error in the DecodeBlock function in codec/sdl image.c, which allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. This may be related to the SDL Image product. The vulnerability can be exploited by a remote attacker using a specially crafted request, potentially leading to a denial of service or arbitrary code execution.
Recommendations
For versions prior to 3.0.9, update to version 3.0.9 or later to resolve the issue. As a temporary workaround, consider disabling the DecodeBlock function in codec/sdl image.c until a patch is available. Restrict access to crafted image files to minimize the risk of exploitation.
Exploit
Fix
DoS
Buffer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Linuxmint
Sdl Image
Ubuntu
Vlc Media Player