CVE-2019-14437
Severity Score
7.8
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly. As a result, a heap-based buffer over-read can be triggered via a crafted .ogg file.
La función xiph_SplitHeaders en el archivo modules/demux/xiph.h en VideoLAN VLC media player versión 3.0.7.1, no comprueba los límites de la matriz apropiadamente. Como resultado, puede ser activada una lectura excesiva del búfer en la región heap de la memoria por medio de un archivo .ogg diseñado.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2019-07-29 CVE Reserved
- 2019-08-21 CVE Published
- 2024-08-05 CVE Updated
- 2024-08-22 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-125: Out-of-bounds Read
- CWE-129: Improper Validation of Array Index
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| https://seclists.org/bugtraq/2019/Aug/36 | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://git.videolan.org/?p=vlc.git&a=search&h=refs%2Fheads%2Fmaster&st=commit&s=cve-2019 | 2020-08-24 | |
| https://www.videolan.org/security/sb-vlc308.html | 2020-08-24 |
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html | 2020-08-24 | |
| http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html | 2020-08-24 | |
| https://security.gentoo.org/glsa/201909-02 | 2020-08-24 | |
| https://usn.ubuntu.com/4131-1 | 2020-08-24 | |
| https://www.debian.org/security/2019/dsa-4504 | 2020-08-24 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Videolan Search vendor "Videolan" | Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player" | 3.0.7.1 Search vendor "Videolan" for product "Vlc Media Player" and version "3.0.7.1" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||