CVE-2020-13428

Un desbordamiento del búfer en la región heap de la memoria en la función hxxx_AnnexB_to_xVC en el archivo modules/packetizer/hxxx_nal.c en el reproductor multimedia VideoLAN VLC en versines anteriores a la 3.0.11 para macOS/iOS permite a los atacantes remotos causar una denegación de servicio (bloqueo de la aplicación) o ejecutar un código arbitrario a través de un archivo de vídeo H.264 Anexo-B elaborado (.avi por ejemplo)

It was discovered that VLC could be made to read out of bounds when decoding image files. If a user were tricked into opening a crafted image file, a remote attacker could possibly use this issue to cause VLC to crash, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. It was discovered that VLC could be made to write out of bounds when processing H.264 video files. If a user were tricked into opening a crafted H.264 video file, a remote attacker could possibly use this issue to cause VLC to crash, leading to a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.