PT-2021-6815 · Videolan+3 · Vlc Media Player+3

Zhen Zhou · Published 2020-08-05 · Updated 2023-06-20 · CVE-2021-25803

Positive Technologies (AI Summary)

CVSS v2.0

8.8

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions VideoLAN VLC Media Player version 3.0.11

Description A buffer overflow vulnerability in the vlc input attachment New component allows attackers to cause an out-of-bounds read via a crafted .avi file. This can be exploited by a remote attacker to gain access to confidential data and cause a denial of service.

Recommendations For version 3.0.11, consider updating to a newer version to mitigate the risk, as the current version is affected by the buffer overflow vulnerability in the vlc input attachment New component. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Integer Overflow

Weakness Enumeration

CWE-120

CWE-190

Related Identifiers

ALT-PU-2020-2503

ALT-PU-2020-3056

BDU:2022-02238

CVE-2021-25803

DLA-2728-1

DSA-4834-1

USN-6180-1

Affected Products

Alt Linux

Linuxmint

Ubuntu

Vlc Media Player

References · 22

• https://code.videolan.org/videolan/vlc-3.0/-/commit/56cbe9c4b59edbdc5e1bb2687992f3bbf492eccb · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-25802 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6180-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-25803 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25803 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-25803 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13428 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6180-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-25801 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2728-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4834-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-25803 · Security Note
• https://ubuntu.com/security/CVE-2021-25804 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19721 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25803 · Vendor Advisory