CVE-2019-13602

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 14-07-2019 11:15

Last modified: - 18-04-2022 06:57

Total changes: - 3

Description

An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Low

Attack complexity

Local

Attack vector

High

Availability

High

Confidentiality

High

Integrity

None

Privileges required

Unchanged

Scope

Required

User interaction

7.8

Base score

1.8

5.9

Exploitability score

Impact score

Verification logic

vendor=videolan AND product=vlc_media_player AND versionEndIncluding=3.0.7.1

vendor=Debian AND product=debian_linux AND version=9.0

vendor=Debian AND product=debian_linux AND version=10.0

vendor=canonical AND product=ubuntu_linux AND version=18.04 AND software_edition=lts

vendor=canonical AND product=ubuntu_linux AND version=19.04

vendor=opensuse AND product=backports_sle AND version=15.0 AND update=-

vendor=opensuse AND product=backports_sle AND version=15.0 AND update=sp1

vendor=opensuse AND product=leap AND version=15.0

vendor=opensuse AND product=leap AND version=15.1

Reference

https://git.videolan.org/?p=vlc.git;a=commit;h=b2b157076d9e94df34502dd8df0787deb940e938
https://git.videolan.org/?p=vlc.git;a=commit;h=8e8e0d72447f8378244f5b4a3dcde036dbeb1491
109158-Broken Link
USN-4074-1-Third Party Advisory
openSUSE-SU-2019:1840-Mailing List, Third Party Advisory
openSUSE-SU-2019:1909-Mailing List, Third Party Advisory
openSUSE-SU-2019:1897-Mailing List, Third Party Advisory
DSA-4504-Third Party Advisory
20190821 [SECURITY] [DSA 4504-1] vlc security update-Mailing List, Third Party Advisory
openSUSE-SU-2019:2015-Mailing List, Third Party Advisory
GLSA-201909-02-Third Party Advisory
openSUSE-SU-2020:0545-Mailing List, Third Party Advisory
openSUSE-SU-2020:0562-Mailing List, Third Party Advisory

Keywords

CVE-2019-13602

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2019-13602

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures