CVSS: 7.8EPSS: 1%CPEs: 9EXPL: 0CVE-2019-13602 – Ubuntu Security Notice USN-4074-1
https://notcve.org/view.php?id=CVE-2019-13602
14 Jul 2019 — An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file. Un desbordamiento inferior de enteros en MP4_EIA608_Convert() en modules/demux/mp4/mp4.c en VideoLAN VLC media player hasta la versión 3.0.7.1 permitiría un atacante remoto causar una denegación de servicio (desbordamiento de buffer bas... • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html • CWE-191: Integer Underflow (Wrap or Wraparound) CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2019-12874 – Ubuntu Security Notice USN-4074-1
https://notcve.org/view.php?id=CVE-2019-12874
18 Jun 2019 — An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while parsing a malformed MKV file type, has a double free. Se descubrió un problema en zlib_decompress_extra en módulos / demux / mkv / util.cpp en el reproductor de medios VideoLAN VLC 3.x a 3.0.7. El demuxer de Matroska, mientras analiza un tipo de archivo MKV con formato incorrecto, tiene un doble libre. It was discovered that the VLC CAF demuxer incorrectl... • http://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=81023659c7de5ac2637b4a879195efef50846102 • CWE-415: Double Free •
CVSS: 6.5EPSS: 15%CPEs: 1EXPL: 0CVE-2019-5439 – Ubuntu Security Notice USN-4074-1
https://notcve.org/view.php?id=CVE-2019-5439
13 Jun 2019 — A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit. Una desbordamiento en el buffer en VLC Media Player Player < 3.0.7 causa un bloqueo el cual, puede ser posiblemente más desarrollado hacia una explotación en la ejecución del código remoto It was discovered that the VLC CAF demuxer incorrectly handled certain files. If a user were tricked into opening a specially-crafted CAF file, a remote attacker could use this issue t... • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.1EPSS: 1%CPEs: 2EXPL: 1CVE-2018-19857 – Ubuntu Security Notice USN-4074-1
https://notcve.org/view.php?id=CVE-2018-19857
05 Dec 2018 — The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer when processing magic cookies in CAF files, because a ReadKukiChunk() cast converts a return value to an unsigned int even if that value is negative. This could result in a denial of service and/or a potential infoleak. El demuxer CAF en modules/demux/caf.c en VideoLAN VLC media player 3.0.4 podría leer memoria desde un puntero no inicializado al procesar cookies mágicas en los archivos CA... • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html • CWE-824: Access of Uninitialized Pointer •
CVSS: 8.0EPSS: 75%CPEs: 2EXPL: 4CVE-2018-11529 – VLC Media Player - MKV Use-After-Free
https://notcve.org/view.php?id=CVE-2018-11529
10 Jul 2018 — VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions. VideoLAN VLC media player en versiones 2.2.x es propenso a una vulnerabilidad de uso de memoria previamente liberada, que podría ser aprovechada por un atacante para ejecutar código arbitrario mediante archivos MKV manipulados. Los intentos de explotación fallidos podrían resultar... • https://packetstorm.news/files/id/149759 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2018-11516
https://notcve.org/view.php?id=CVE-2018-11516
28 May 2018 — The vlc_demux_chained_Delete function in input/demux_chained.c in VideoLAN VLC media player 3.0.1 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly have unspecified other impact via a crafted .swf file. PI Coresight 2016 R2 contiene una vulnerabilidad de Cross-Site Request Forgery (CSRF) que podría permitir el acceso al sistema PI. OSIsoft recomienda que los usuarios actualicen a PI Vision 2017 o siguientes para mitigar esta vulnerabilidad. • http://code610.blogspot.com/2018/05/make-free-vlc.html • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 2EXPL: 1CVE-2017-17670 – Debian Security Advisory 4203-1
https://notcve.org/view.php?id=CVE-2017-17670
15 Dec 2017 — In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules/demux/mp4/libmp4.c in the MP4 demux module leading to a invalid free, because the type of a box may be changed between a read operation and a free operation. En VideoLAN VLC media player, hasta la versión 2.2.8, hay una vulnerabilidad de conversión de tipos en modules/demux/mp4/libmp4.c en el módulo MP4 demux que conduce a una liberación no válida. Esto se debe a que el tipo de una caja podría cambiarse entre una... • http://openwall.com/lists/oss-security/2017/12/15/1 • CWE-416: Use After Free •
CVSS: 9.8EPSS: 0%CPEs: 9EXPL: 0CVE-2017-10699 – Debian Security Advisory 4045-1
https://notcve.org/view.php?id=CVE-2017-10699
30 Jun 2017 — avcodec 2.2.x, as used in VideoLAN VLC media player 2.2.7-x before 2017-06-29, allows out-of-bounds heap memory write due to calling memcpy() with a wrong size, leading to a denial of service (application crash) or possibly code execution. avcodec 2.2.x, tal y como se emplea en el reproductor multimedia VideoLAN VLC en versiones 2.2.7-x anteriores a la 2017-06-29, permite una escritura en la memoria dinámica (heap) fuera de límites debido a que se llama a memcpy() con un tamaño erróneo. Esto conduce a una d... • http://www.securitytracker.com/id/1038816 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-9300 – Debian Security Advisory 4045-1
https://notcve.org/view.php?id=CVE-2017-9300
29 May 2017 — plugins\codec\libflac_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly have unspecified other impact via a crafted FLAC file. Plugins/codec/libflac_plugin.dll en VideoLAN VLC media player 2.2.4 permitiría un atacante remoto causar una denegación de servicio (corrupción de memoria dinámica -heap- y fallo de aplicación) o posiblemente tener otro impacto no especificado a través de un archivo FLAC especialment... • http://code610.blogspot.com/2017/04/multiple-crashes-in-vlc-224.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-9301
https://notcve.org/view.php?id=CVE-2017-9301
29 May 2017 — plugins\audio_filter\libmpgatofixed32_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (invalid read and application crash) or possibly have unspecified other impact via a crafted file. plugins/audio_filter/libmpgatofixed32_plugin.dll en VideoLAN VLC media player 2.2.4 permite a un atacante remoto causar una denegación de servicio (lectura invalida y fallo de aplicación) o posiblemente tener otro impacto no especificado a través de un archivo especialmente d... • http://code610.blogspot.com/2017/04/multiple-crashes-in-vlc-224.html • CWE-125: Out-of-bounds Read •