PT-2020-6646 · Videolan+3 · Vlc Media Player+3

Published 2020-07-26 · Updated 2023-06-20 · CVE-2021-25802

Positive Technologies (AI Summary)

CVSS v2.0

8.8

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions VLC Media Player version 3.0.11

Description A buffer overflow vulnerability in the AVI ExtractSubtitle component allows attackers to cause an out-of-bounds read via a crafted .avi file. This can be exploited by a remote attacker to gain access to confidential data and cause a denial of service.

Recommendations For version 3.0.11, consider disabling the AVI ExtractSubtitle component until a patch is available to prevent exploitation via crafted .avi files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Buffer Overflow

Weakness Enumeration

CWE-125

CWE-120

Related Identifiers

ALT-PU-2020-2503

ALT-PU-2020-3056

BDU:2022-02239

CVE-2021-25802

DLA-2728-1

DSA-4834-1

USN-6180-1

Affected Products

Alt Linux

Linuxmint

Ubuntu

Vlc Media Player

References · 22

• https://ubuntu.com/security/CVE-2019-19721 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6180-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25802 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-25802 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13428 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02239 · Security Note
• https://ubuntu.com/security/CVE-2021-25803 · Vendor Advisory
• https://code.videolan.org/videolan/vlc-3.0/-/commit/0660acc3ab64d2c3ad99cae887a438f0648faa72 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-25804 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-25801 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-25802 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-25802 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25802 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2728-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-25802 · Vendor Advisory