PT-2021-6810 · Videolan+3 · Vlc Media Player+3

Zhen Zhou · Published 2020-08-05 · Updated 2023-06-20 · CVE-2021-25804

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions VLC Media Player version 3.0.11

Description The issue is related to a NULL-pointer dereference in the Open function within the avi.c file of the VLC Media Player. This can cause a denial of service (DOS) in the application, allowing a remote attacker to disrupt service.

Recommendations For version 3.0.11, consider disabling the Open function in avi.c as a temporary workaround until a patch is available. Restrict access to the avi.c component to minimize the risk of exploitation. Avoid using the Open function in the affected avi.c file until the issue is resolved.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2020-2503

ALT-PU-2020-3056

BDU:2022-02233

CVE-2021-25804

DLA-2728-1

DSA-4834-1

USN-6180-1

Affected Products

Alt Linux

Linuxmint

Ubuntu

Vlc Media Player

References · 21

• https://security-tracker.debian.org/tracker/CVE-2021-25804 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-25802 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-25804 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6180-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25804 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13428 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-25801 · Vendor Advisory
• https://code.videolan.org/videolan/vlc-3.0/-/commit/a7f577ec26d35bbd7b2a3cda89d1b41bde69de9c · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-25804 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-25804 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2728-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-25803 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4834-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-25804 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25804 · Security Note