lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player up to and including 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
videolan vlc media player |
||
opensuse leap 15.0 |
||
opensuse leap 15.1 |
||
opensuse backports sle 15.0 |
||
debian debian linux 9.0 |
||
debian debian linux 10.0 |
||
canonical ubuntu linux 18.04 |
||
canonical ubuntu linux 19.04 |
Keep your media player, like other apps, up to date: 13 security flaws fixed Dodgy vids can hijack PCs via VLC security flaw, US, Germany warn. Software's makers not app-y with that claim
VideoLAN has issued an update to address a baker's dozen of CVE-listed security vulnerabilities in its widely used VLC player software. The VLC update includes patches to clear up flaws that range in impact from denial of service (read: application crashes) to remote code execution (i.e. malware installation). Users and admins can get fixes for all of the vulnerabilities by updating VLC to version 3.0.8 or later. So far, no attacks exploiting these holes have been reported in the wild. "While th...
Vulmon