FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-04-24 03:12:49 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
4a10902f-8a48-11ea-8668-e0d55e2a8bf9	vlc -- Multiple vulnerabilities fixed in VLC media player VideoLAN reports: Details A remote user could: Create a specifically crafted image file that could trigger an out of bounds read Send a specifically crafter request to the microdns service discovery, potentially triggering various memory management issues Impact If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user. While these issues in themselves are most likely to just crash the player, we can't exclude that they could be combined to leak user informations or remotely execute code. ASLR and DEP help reduce the likelyness of code execution, but may be bypassed. We have not seen exploits performing code execution through these vulnerabilities CVE-2019-19721 affects VLC 3.0.8 and earlier, and only reads 1 byte out of bound Discovery 2020-04-01 Entry 2020-04-29 vlc < 3.0.10,4 https://www.videolan.org/security/sb-vlc309.html
77896891-b08a-11ea-937b-b42e99a1b9c3	vlc heap-based buffer overflow Thomas Guillem reports: A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file. Discovery 2020-05-27 Entry 2020-06-17 vlc < 3.0.11,4 https://nvd.nist.gov/vuln/detail/CVE-2020-13428 CVE-2020-13428

VuXML ID

Description

4a10902f-8a48-11ea-8668-e0d55e2a8bf9

vlc -- Multiple vulnerabilities fixed in VLC media player

VideoLAN reports:

Details

A remote user could:

Create a specifically crafted image file that could trigger an out of bounds read

Send a specifically crafter request to the microdns service discovery, potentially triggering various memory management issues

Impact

If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user.
While these issues in themselves are most likely to just crash the player, we can't exclude that they could be combined to leak user informations or remotely execute code. ASLR and DEP help reduce the likelyness of code execution, but may be bypassed.

We have not seen exploits performing code execution through these vulnerabilities

CVE-2019-19721 affects VLC 3.0.8 and earlier, and only reads 1 byte out of bound

Discovery 2020-04-01
Entry 2020-04-29
vlc

< 3.0.10,4

https://www.videolan.org/security/sb-vlc309.html

77896891-b08a-11ea-937b-b42e99a1b9c3

vlc heap-based buffer overflow

Thomas Guillem reports:

A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.

Discovery 2020-05-27
Entry 2020-06-17
vlc

< 3.0.11,4

https://nvd.nist.gov/vuln/detail/CVE-2020-13428
CVE-2020-13428