Vulnerabilities > CVE-2019-13962 - Out-of-bounds Read vulnerability in multiple products

047910
CVSS 9.8 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
videolan
opensuse
debian
canonical
CWE-125
critical
nessus

Summary

lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.

Vulnerable Configurations

Part Description Count
Application
Videolan
53
Application
Opensuse
2
OS
Opensuse
2
OS
Debian
2
OS
Canonical
2

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Overread Buffers
    An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

Nessus

  • NASL familyWindows
    NASL idVLC_3_0_8.NASL
    descriptionThe version of VLC media player installed on the remote Windows host is prior to 3.0.8. It is, therefore, affected by multiple vulnerabilities: - An integer underflow condition exists in the modules/demux/mp4/mp4.c component of VLC Player. An unauthenticated, remote attacker can exploit this, by supplying a crafted mp4 file, to cause a denial of service condition or the execution of arbitrary code (CVE-2019-13602). - A heap-based buffer overflow condition exists in the modules/codec/avcodec/video.c component of VLC Player due to improper sanitization of the width and height values. A remote attacker can exploit this, by supplying a specially crafted video file, to cause a denial of service condition or the execution of arbitrary code (CVE-2019-13962). - A NULL pointer de-reference flaw exists in the ASF Demuxer component of VLC Player. An unauthenticated, remote attacker can exploit this, by supplying crafted input, to cause a denial of service condition when the application attempts to read or write memory with a NULL pointer (CVE-2019-14534).
    last seen2020-05-09
    modified2019-08-23
    plugin id128080
    published2019-08-23
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128080
    titleVLC < 3.0.8 Multiple Vulnerabilities
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4504.NASL
    descriptionMultiple security issues were discovered in the VLC media player, which could result in the execution of arbitrary code or denial of service if a malformed file/stream is processed.
    last seen2020-06-01
    modified2020-06-02
    plugin id128066
    published2019-08-22
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128066
    titleDebian DSA-4504-1 : vlc - security update
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-1909.NASL
    descriptionThis update for vlc to version 3.0.7.1 fixes the following issues : Security issues fixed : - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354). - CVE-2019-5459: Fixed an integer underflow (bsc#1143549). - CVE-2019-5460: Fixed a double free (bsc#1143547). - CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933). - CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522). - CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161). Non-security issues fixed : - Video Output : - Fix hardware acceleration with some AMD drivers - Improve direct3d11 HDR support - Access : - Improve Blu-ray support - Audio output : - Fix pass-through on Android-23 - Fix DirectSound drain - Demux: Improve MP4 support - Video Output : - Fix 12 bits sources playback with Direct3D11 - Fix crash on iOS - Fix midstream aspect-ratio changes when Windows hardware decoding is on - Fix HLG display with Direct3D11 - Stream Output: Improve Chromecast support with new ChromeCast apps - Misc : - Update Youtube, Dailymotion, Vimeo, Soundcloud scripts - Work around busy looping when playing an invalid item with loop enabled - Updated translations. New package libaom : - Initial version 1.0.0 - A library for AOMedia Video 1 (AV1), an open, royalty-free video coding format designed for video transmissions over the Internet.
    last seen2020-05-09
    modified2019-08-20
    plugin id128001
    published2019-08-20
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128001
    titleopenSUSE Security Update : vlc (openSUSE-2019-1909)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201909-02.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201909-02 (VLC: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in VLC. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifiers for details. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id128591
    published2019-09-09
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128591
    titleGLSA-201909-02 : VLC: Multiple vulnerabilities
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4131-1.NASL
    descriptionIt was discovered that VLC incorrectly handled certain media files. If a user were tricked into opening a specially crafted file, a remote attacker could use this issue to cause VLC to crash, resulting in a denial of service, or possibly execute arbitrary code. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id128756
    published2019-09-12
    reporterUbuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128756
    titleUbuntu 18.04 LTS / 19.04 : vlc vulnerabilities (USN-4131-1)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-1840.NASL
    descriptionThis update for vlc to version 3.0.7.1 fixes the following issues : Security issues fixed : &#9; - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354). - CVE-2019-5459: Fixed an integer underflow (bsc#1143549). - CVE-2019-5460: Fixed a double free (bsc#1143547). - CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933). - CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522). - CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161). Non-security issues fixed : - Video Output : - Fix hardware acceleration with some AMD drivers - Improve direct3d11 HDR support - Access : - Improve Blu-ray support - Audio output : - Fix pass-through on Android-23 - Fix DirectSound drain - Demux: Improve MP4 support - Video Output : - Fix 12 bits sources playback with Direct3D11 - Fix crash on iOS - Fix midstream aspect-ratio changes when Windows hardware decoding is on - Fix HLG display with Direct3D11 - Stream Output: Improve Chromecast support with new ChromeCast apps - Misc : - Update Youtube, Dailymotion, Vimeo, Soundcloud scripts - Work around busy looping when playing an invalid item with loop enabled - Updated translations.
    last seen2020-05-09
    modified2019-08-12
    plugin id127743
    published2019-08-12
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127743
    titleopenSUSE Security Update : vlc (openSUSE-2019-1840)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2020-545.NASL
    descriptionThis update for vlc fixes the following issues : vlc was updated to version 3.0.9.2 : + Misc: Properly bump the version in configure.ac. Changes from version 3.0.9.1 : + Misc: Fix VLSub returning 401 for earch request. Changes from version 3.0.9 : + Core: Work around busy looping when playing an invalid item through VLM. + Access : - Multiple dvdread and dvdnav crashs fixes - Fixed DVD glitches on clip change - Fixed dvdread commands/data sequence inversion in some cases causing unwanted glitches - Better handling of authored as corrupted DVD - Added libsmb2 support for SMB2/3 shares + Demux : - Fix TTML entities not passed to decoder - Fixed some WebVTT styling tags being not applied - Misc raw H264/HEVC frame rate fixes - Fix adaptive regression on TS format change (mostly HLS) - Fixed MP4 regression with twos/sowt PCM audio - Fixed some MP4 raw quicktime and ms-PCM audio - Fixed MP4 interlacing handling - Multiple adaptive stack (DASH/HLS/Smooth) fixes - Enabled Live seeking for HLS - Fixed seeking in some cases for HLS - Improved Live playback for Smooth and DASH - Fixed adaptive unwanted end of stream in some cases - Faster adaptive start and new buffering control options + Packetizers : - Fixes H264/HEVC incomplete draining in some cases - packetizer_helper: Fix potential trailing junk on last packet - Added missing drain in packetizers that was causing missing last frame or audio - Improved check to prevent fLAC synchronization drops + Decoder : - avcodec: revector video decoder to fix incomplete drain - spudec: implemented palette updates, fixing missing subtitles on some DVD - Fixed WebVTT CSS styling not being applied on Windows/macOS - Fixed Hebrew teletext pages support in zvbi - Fixed Dav1d aborting decoding on corrupted picture - Extract and display of all CEA708 subtitles - Update libfaad to 2.9.1 - Add DXVA support for VP9 Profile 2 (10 bits) - Mediacodec aspect ratio with Amazon devices + Audio output : - Added support for iOS audiounit audio above 48KHz - Added support for amem audio up to 384KHz + Video output : - Fix for opengl glitches in some drivers - Fix GMA950 opengl support on macOS - YUV to RGB StretchRect fixes with NVIDIA drivers - Use libpacebo new tone mapping desaturation algorithm + Text renderer : - Fix crashes on macOS with SSA/ASS subtitles containing emoji - Fixed unwanted growing background in Freetype rendering and Y padding + Mux: Fixed some YUV mappings + Service Discovery: Update libmicrodns to 0.1.2. + Misc : - Update YouTube, SoundCloud and Vocaroo scripts: this restores playback of YouTube URLs. - Add missing .wpl & .zpl file associations on Windows - Improved chromecast audio quality Update to version 3.0.8
    last seen2020-04-30
    modified2020-04-27
    plugin id136008
    published2020-04-27
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136008
    titleopenSUSE Security Update : vlc (openSUSE-2020-545)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_795442E7C35511E982245404A68AD561.NASL
    descriptionThe VLC project reports : Security : * Fix a buffer overflow in the MKV demuxer (CVE-2019-14970) * Fix a read buffer overflow in the avcodec decoder (CVE-2019-13962) * Fix a read buffer overflow in the FAAD decoder * Fix a read buffer overflow in the OGG demuxer (CVE-2019-14437, CVE-2019-14438) * Fix a read buffer overflow in the ASF demuxer (CVE-2019-14776) * Fix a use after free in the MKV demuxer (CVE-2019-14777, CVE-2019-14778) * Fix a use after free in the ASF demuxer (CVE-2019-14533) * Fix a couple of integer underflows in the MP4 demuxer (CVE-2019-13602) * Fix a null dereference in the dvdnav demuxer * Fix a null dereference in the ASF demuxer (CVE-2019-14534) * Fix a null dereference in the AVI demuxer * Fix a division by zero in the CAF demuxer (CVE-2019-14498) * Fix a division by zero in the ASF demuxer (CVE-2019-14535)
    last seen2020-05-09
    modified2019-08-21
    plugin id128042
    published2019-08-21
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128042
    titleFreeBSD : vlc -- multiple vulnerabilities (795442e7-c355-11e9-8224-5404a68ad561)