PT-2021-30848 · Videolan · Vlc

Published 2021-06-08 · Updated 2021-06-08

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions VLC (affected versions not specified)

Description A remote user can create a specifically crafted file to trigger various issues, including remote code execution through a crafted playlist by tricking the user into interacting with its elements. Additionally, read or write buffer overflows can be triggered with crafted files or through a Man-In-The-Middle (MITM) attack on the automatic updater. If successful, this could result in either a crash of VLC or arbitrary code execution with the privileges of the target user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

MGASA-2021-0227

Affected Products

Vlc

References · 7

• https://osv.dev/vulnerability/MGASA-2021-0227 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0227.html · Security Note
• https://videolan.org/vlc/releases/3.0.13.html · Note
• https://git.videolan.org/?p=vlc/vlc-3.0.git;a=blob;f=NEWS;h=e5dd1855e797179ec3a0bee2cae4ac68705a70cc;hb=41878ff4f2a4b566cf0a1bd15f72037b2be98a18 · Note
• https://bugs.mageia.org/show_bug.cgi?id=28930 · Note
• https://videolan.org/security/sb-vlc3013.html · Note
• https://code.videolan.org/videolan/vlc-3.0/-/raw/master/NEWS · Note