FreshPorts - VuXML

VideoLAN reports:

When parsing a MP4, ASF or AVI file with an overly deep box structure, a stack overflow might occur. It would overwrite the return address and thus redirect the execution flow.

If successful, a malicious third party could trigger execution of arbitrary code within the context of the VLC media player.

ge 0.5.0 lt 1.0.2

VideoLAN reports:

Details

A remote user could:

• Create a specifically crafted image file that could trigger an out of bounds read
• Send a specifically crafter request to the microdns service discovery, potentially triggering various memory management issues

Impact

If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user.

While these issues in themselves are most likely to just crash the player, we can't exclude that they could be combined to leak user informations or remotely execute code. ASLR and DEP help reduce the likelyness of code execution, but may be bypassed.

We have not seen exploits performing code execution through these vulnerabilities

CVE-2019-19721 affects VLC 3.0.8 and earlier, and only reads 1 byte out of bound

< 3.0.10,4

The VLC Team reports:

The VLC media player contains a stack overflow vulnerability while parsing malformed cue files. The vulnerability may be exploited by a (remote) attacker to execute arbitrary code in the context of VLC media player.

< 0.8.6.i_2,2

< 0.9.6,3

The VLC project reports:

mkv: Fix potential double free

< 3.0.7.1,4

Jean-Baptiste Kempf, on behalf of the VideoLAN project reports:

If successful, a malicious third party could crash the VLC media player process. Arbitrary code execution could be possible on some systems.

< 2.0.1,3

VideoLAN project reports:

When parsing some MP4 (MPEG-4 Part 14) files, insufficient buffer size might lead to corruption of the heap.

ge 1.0.0 lt 1.1.9

The VLC project reports:

Fix out-of-bound write in adpcm QT IMA codec (CVE-2016-5108)

< 2.2.4,4

< 2.2.4,4

isecpartners reports:

VLC is vulnerable to a format string attack in the parsing of Vorbis comments in Ogg Vorbis and Ogg Theora files, CDDA data or SAP/SDP service discovery messages. Additionally, there are two errors in the handling of wav files, one a denial of service due to an uninitialized variable, and one integer overflow in sampling frequency calculations.

< 0.8.6c

VideoLAN project reports:

VLC media player suffers from various vulnerabilities when attempting to parse malformatted or overly long byte streams.

< 1.0.6

Thomas Guillem reports:

A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.

< 3.0.11,4

The VLC project reports:

Security: * Fix a buffer overflow in the MKV demuxer (CVE-2019-14970) * Fix a read buffer overflow in the avcodec decoder (CVE-2019-13962) * Fix a read buffer overflow in the FAAD decoder * Fix a read buffer overflow in the OGG demuxer (CVE-2019-14437, CVE-2019-14438) * Fix a read buffer overflow in the ASF demuxer (CVE-2019-14776) * Fix a use after free in the MKV demuxer (CVE-2019-14777, CVE-2019-14778) * Fix a use after free in the ASF demuxer (CVE-2019-14533) * Fix a couple of integer underflows in the MP4 demuxer (CVE-2019-13602) * Fix a null dereference in the dvdnav demuxer * Fix a null dereference in the ASF demuxer (CVE-2019-14534) * Fix a null dereference in the AVI demuxer * Fix a division by zero in the CAF demuxer (CVE-2019-14498) * Fix a division by zero in the ASF demuxer (CVE-2019-14535)

< 3.0.8,4

oCERT reports:

The stable VLC version suffers from an arbitrary pointer dereference vulnerability.

The vulnerability affects the 3GP file format parser, insufficient restrictions on a writable buffer can be exploited to execute arbitrary code via the heap memory. A specific 3GP file can be crafted to trigger the vulnerability.

Credit: vulnerability reported by Loren Maggiore of Trail of Bits.

< 2.2.1_5,4

Mitre reports:

VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.

le 2.2.8_6,4

le 2.2.8_6,4

VideoLAN project reports:

VLC fails to perform sufficient input validation when trying to extract some meta-informations about input media through ID3v2 tags. In the failure case, VLC attempt dereference an invalid memory address, and a crash will ensure.

gt 0.9.0,3 lt 1.1.2_1,3

Check Point research team reports:

Remote code execution via crafted subtitles

< 2.2.6,4

< 2.2.6,4

zhangyang reports:

The ReadFrame function in the avi.c file uses a variable i_width_bytes, which is obtained directly from the file. It is a signed integer. It does not do a strict check before the memory operation(memmove, memcpy), which may cause a buffer overflow.

< 3.0.7,4

VLC team reports:

When parsing an invalid MKV (Matroska or WebM) file, input validation are insufficient.

< 1.1.7