lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-vlc | Nov 8, 2019 | Jul 18, 2019 | |
| Debian | debian-upgrade-vlc | Aug 22, 2019 | Jul 18, 2019 | |
| Freebsd | freebsd-upgrade-package-vlc | Aug 21, 2019 | Aug 20, 2019 | |
| Gentoo Linux | gentoo-linux-upgrade-media-video-vlc | Sep 9, 2019 | Jul 18, 2019 | |
| Suse | — | suse-upgrade-aom-toolssuse-upgrade-libaom-develsuse-upgrade-libaom-devel-docsuse-upgrade-libaom0suse-upgrade-libaom0-64bitsuse-upgrade-libvlc5suse-upgrade-libvlccore9suse-upgrade-vlcsuse-upgrade-vlc-codec-gstreamersuse-upgrade-vlc-develsuse-upgrade-vlc-jacksuse-upgrade-vlc-langsuse-upgrade-vlc-noxsuse-upgrade-vlc-opencvsuse-upgrade-vlc-qtsuse-upgrade-vlc-vdpau | Aug 9, 2019 | Jul 18, 2019 |
| Ubuntu | ubuntu-upgrade-vlc | Sep 12, 2019 | Jul 18, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub