Vulnerabilities > CVE-2018-19857 - Access of Uninitialized Pointer vulnerability in multiple products

047910
CVSS 9.1 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
videolan
debian
CWE-824
critical
nessus

Summary

The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer when processing magic cookies in CAF files, because a ReadKukiChunk() cast converts a return value to an unsigned int even if that value is negative. This could result in a denial of service and/or a potential infoleak.

Vulnerable Configurations

Part Description Count
Application
Videolan
1
OS
Debian
1

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyWindows
    NASL idVLC_3_0_5.NASL
    descriptionThe version of VLC media player installed on the remote host with version 3.0.4. It is, therefore, affected by a denial of service and/or a potential infoleak vulnerability. (CVE-2018-19857).
    last seen2020-06-05
    modified2020-05-27
    plugin id136895
    published2020-05-27
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136895
    titleVLC < 3.0.5 Denial of Service and/or Infoleak Vulnerability
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include('compat.inc');
    
    if (description)
    {
      script_id(136895);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2018-19857");
      script_bugtraq_id(106130);
    
      script_name(english:"VLC < 3.0.5 Denial of Service and/or Infoleak Vulnerability");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host contains a media player that is affected by denial of service and/or a potential infoleak vulnerability.");
      script_set_attribute(attribute:"description", value:
    "The version of VLC media player installed on the remote host with version 3.0.4.  It is, therefore, affected 
    by a denial of service and/or a potential infoleak vulnerability. (CVE-2018-19857).");
      script_set_attribute(attribute:"see_also", value:"https://www.securityfocus.com/bid/106130");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to VLC version 3.0.5 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-19857");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/12/05");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/12/05");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/05/27");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:videolan:vlc_media_player");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("vlc_installed.nasl");
      script_require_keys("SMB/VLC/Version", "installed_sw/VLC media player");
    
      exit(0);
    }
    
    include('vcf.inc');
    
    app_info = vcf::get_app_info(app:'VLC media player', win_local:TRUE);
    
    constraints = [{'fixed_version':'3.0.5'}];
    
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4074-1.NASL
    descriptionIt was discovered that the VLC CAF demuxer incorrectly handled certain files. If a user were tricked into opening a specially crafted CAF file, a remote attacker could use this issue to cause VLC to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-19857) It was discovered that the VLC Matroska demuxer incorrectly handled certain files. If a user were tricked into opening a specially crafted MKV file, a remote attacker could use this issue to cause VLC to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-12874) It was discovered that the VLC MP4 demuxer incorrectly handled certain files. If a user were tricked into opening a specially crafted MP4 file, a remote attacker could use this issue to cause VLC to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-13602) It was discovered that the VLC AVI demuxer incorrectly handled certain files. If a user were tricked into opening a specially crafted AVI file, a remote attacker could use this issue to cause VLC to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-5439). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-09
    modified2019-07-26
    plugin id127095
    published2019-07-26
    reporterUbuntu Security Notice (C) 2019-2020 Canonical, Inc. / NASL script (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127095
    titleUbuntu 18.04 LTS / 19.04 : vlc vulnerabilities (USN-4074-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-4074-1. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(127095);
      script_version("1.6");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/08");
    
      script_cve_id("CVE-2018-19857", "CVE-2019-12874", "CVE-2019-13602", "CVE-2019-5439");
      script_xref(name:"USN", value:"4074-1");
      script_xref(name:"IAVB", value:"2019-B-0074-S");
    
      script_name(english:"Ubuntu 18.04 LTS / 19.04 : vlc vulnerabilities (USN-4074-1)");
      script_summary(english:"Checks dpkg output for updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Ubuntu host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "It was discovered that the VLC CAF demuxer incorrectly handled certain
    files. If a user were tricked into opening a specially crafted CAF
    file, a remote attacker could use this issue to cause VLC to crash,
    resulting in a denial of service. This issue only affected Ubuntu
    18.04 LTS. (CVE-2018-19857)
    
    It was discovered that the VLC Matroska demuxer incorrectly handled
    certain files. If a user were tricked into opening a specially crafted
    MKV file, a remote attacker could use this issue to cause VLC to
    crash, resulting in a denial of service, or possibly execute arbitrary
    code. (CVE-2019-12874)
    
    It was discovered that the VLC MP4 demuxer incorrectly handled certain
    files. If a user were tricked into opening a specially crafted MP4
    file, a remote attacker could use this issue to cause VLC to crash,
    resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2019-13602)
    
    It was discovered that the VLC AVI demuxer incorrectly handled certain
    files. If a user were tricked into opening a specially crafted AVI
    file, a remote attacker could use this issue to cause VLC to crash,
    resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2019-5439).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/4074-1/"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected vlc package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:vlc");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:19.04");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/12/05");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/07/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/07/26");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_set_attribute(attribute:"stig_severity", value:"I");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2019-2020 Canonical, Inc. / NASL script (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(18\.04|19\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 18.04 / 19.04", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"18.04", pkgname:"vlc", pkgver:"3.0.7.1-0ubuntu18.04.1")) flag++;
    if (ubuntu_check(osver:"19.04", pkgname:"vlc", pkgver:"3.0.7.1-0ubuntu19.04.1")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "vlc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-1909.NASL
    descriptionThis update for vlc to version 3.0.7.1 fixes the following issues : Security issues fixed : - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354). - CVE-2019-5459: Fixed an integer underflow (bsc#1143549). - CVE-2019-5460: Fixed a double free (bsc#1143547). - CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933). - CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522). - CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161). Non-security issues fixed : - Video Output : - Fix hardware acceleration with some AMD drivers - Improve direct3d11 HDR support - Access : - Improve Blu-ray support - Audio output : - Fix pass-through on Android-23 - Fix DirectSound drain - Demux: Improve MP4 support - Video Output : - Fix 12 bits sources playback with Direct3D11 - Fix crash on iOS - Fix midstream aspect-ratio changes when Windows hardware decoding is on - Fix HLG display with Direct3D11 - Stream Output: Improve Chromecast support with new ChromeCast apps - Misc : - Update Youtube, Dailymotion, Vimeo, Soundcloud scripts - Work around busy looping when playing an invalid item with loop enabled - Updated translations. New package libaom : - Initial version 1.0.0 - A library for AOMedia Video 1 (AV1), an open, royalty-free video coding format designed for video transmissions over the Internet.
    last seen2020-05-09
    modified2019-08-20
    plugin id128001
    published2019-08-20
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128001
    titleopenSUSE Security Update : vlc (openSUSE-2019-1909)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2019-1909.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(128001);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/08");
    
      script_cve_id("CVE-2018-19857", "CVE-2019-12874", "CVE-2019-13602", "CVE-2019-13962", "CVE-2019-5439", "CVE-2019-5459", "CVE-2019-5460");
      script_xref(name:"IAVB", value:"2019-B-0074-S");
    
      script_name(english:"openSUSE Security Update : vlc (openSUSE-2019-1909)");
      script_summary(english:"Check for the openSUSE-2019-1909 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for vlc to version 3.0.7.1 fixes the following issues :
    
    Security issues fixed :
    
      - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354).
    
      - CVE-2019-5459: Fixed an integer underflow (bsc#1143549).
    
      - CVE-2019-5460: Fixed a double free (bsc#1143547).
    
      - CVE-2019-12874: Fixed a double free in
        zlib_decompress_extra in modules/demux/mkv/util.cpp
        (bsc#1138933).
    
      - CVE-2019-13602: Fixed an integer underflow in mp4
        demuxer (boo#1141522).
    
      - CVE-2019-13962: Fixed a heap-based buffer over-read in
        avcodec (boo#1142161).
    
    Non-security issues fixed :
    
      - Video Output :
    
      - Fix hardware acceleration with some AMD drivers
    
      - Improve direct3d11 HDR support
    
      - Access :
    
      - Improve Blu-ray support
    
      - Audio output :
    
      - Fix pass-through on Android-23
    
      - Fix DirectSound drain
    
      - Demux: Improve MP4 support
    
      - Video Output :
    
      - Fix 12 bits sources playback with Direct3D11
    
      - Fix crash on iOS
    
      - Fix midstream aspect-ratio changes when Windows hardware
        decoding is on
    
      - Fix HLG display with Direct3D11
    
      - Stream Output: Improve Chromecast support with new
        ChromeCast apps
    
      - Misc :
    
      - Update Youtube, Dailymotion, Vimeo, Soundcloud scripts
    
      - Work around busy looping when playing an invalid item
        with loop enabled
    
      - Updated translations.
    
    New package libaom :
    
      - Initial version 1.0.0
    
      - A library for AOMedia Video 1 (AV1), an open,
        royalty-free video coding format designed for video
        transmissions over the Internet."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1093732"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1094893"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1118586"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1133290"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1138354"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1138933"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1141522"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1142161"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1143547"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1143549"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected vlc packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:aom-tools");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:aom-tools-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libaom-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libaom-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libaom0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libaom0-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libvlc5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libvlc5-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libvlccore9");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libvlccore9-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:vlc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:vlc-codec-gstreamer");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:vlc-codec-gstreamer-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:vlc-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:vlc-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:vlc-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:vlc-jack");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:vlc-jack-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:vlc-lang");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:vlc-noX");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:vlc-noX-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:vlc-qt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:vlc-qt-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:vlc-vdpau");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:vlc-vdpau-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/12/05");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/08/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/08/20");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_set_attribute(attribute:"stig_severity", value:"I");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE15\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.0", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE15.0", reference:"aom-tools-1.0.0-lp150.2.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"aom-tools-debuginfo-1.0.0-lp150.2.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libaom-debugsource-1.0.0-lp150.2.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libaom-devel-1.0.0-lp150.2.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libaom0-1.0.0-lp150.2.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libaom0-debuginfo-1.0.0-lp150.2.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libvlc5-3.0.7.1-lp150.8.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libvlc5-debuginfo-3.0.7.1-lp150.8.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libvlccore9-3.0.7.1-lp150.8.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libvlccore9-debuginfo-3.0.7.1-lp150.8.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"vlc-3.0.7.1-lp150.8.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"vlc-codec-gstreamer-3.0.7.1-lp150.8.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"vlc-codec-gstreamer-debuginfo-3.0.7.1-lp150.8.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"vlc-debuginfo-3.0.7.1-lp150.8.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"vlc-debugsource-3.0.7.1-lp150.8.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"vlc-devel-3.0.7.1-lp150.8.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"vlc-jack-3.0.7.1-lp150.8.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"vlc-jack-debuginfo-3.0.7.1-lp150.8.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"vlc-lang-3.0.7.1-lp150.8.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"vlc-noX-3.0.7.1-lp150.8.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"vlc-noX-debuginfo-3.0.7.1-lp150.8.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"vlc-qt-3.0.7.1-lp150.8.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"vlc-qt-debuginfo-3.0.7.1-lp150.8.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"vlc-vdpau-3.0.7.1-lp150.8.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"vlc-vdpau-debuginfo-3.0.7.1-lp150.8.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "aom-tools / aom-tools-debuginfo / libaom-debugsource / libaom-devel / etc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-1840.NASL
    descriptionThis update for vlc to version 3.0.7.1 fixes the following issues : Security issues fixed : &#9; - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354). - CVE-2019-5459: Fixed an integer underflow (bsc#1143549). - CVE-2019-5460: Fixed a double free (bsc#1143547). - CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933). - CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522). - CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161). Non-security issues fixed : - Video Output : - Fix hardware acceleration with some AMD drivers - Improve direct3d11 HDR support - Access : - Improve Blu-ray support - Audio output : - Fix pass-through on Android-23 - Fix DirectSound drain - Demux: Improve MP4 support - Video Output : - Fix 12 bits sources playback with Direct3D11 - Fix crash on iOS - Fix midstream aspect-ratio changes when Windows hardware decoding is on - Fix HLG display with Direct3D11 - Stream Output: Improve Chromecast support with new ChromeCast apps - Misc : - Update Youtube, Dailymotion, Vimeo, Soundcloud scripts - Work around busy looping when playing an invalid item with loop enabled - Updated translations.
    last seen2020-05-09
    modified2019-08-12
    plugin id127743
    published2019-08-12
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127743
    titleopenSUSE Security Update : vlc (openSUSE-2019-1840)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4366.NASL
    descriptionAn integer underflow was discovered in the CAF demuxer of the VLC media player.
    last seen2020-03-17
    modified2019-01-14
    plugin id121135
    published2019-01-14
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121135
    titleDebian DSA-4366-1 : vlc - security update