Arch Linux Security Advisory ASA-201906-22 ========================================== Severity: Critical Date : 2019-06-25 CVE-ID : CVE-2019-5439 CVE-2019-12874 Package : vlc Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-998 Summary ======= The package vlc before version 3.0.7.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.0.7.1-1. # pacman -Syu "vlc>=3.0.7.1-1" The problems have been fixed upstream in version 3.0.7.1. Workaround ========== None. Description =========== - CVE-2019-5439 (arbitrary code execution) VideoLAN VLC media player 3.0.6 and earlier has a out-of-bounds write has been found in the ReadFrame function of the AVI decoder. - CVE-2019-12874 (arbitrary code execution) VideoLAN VLC media player 3.0.6 and earlier has a double-free in the zlib_decompress_extra function of the Matroska demuxer in modules/demux/mkv/util.cpp. Impact ====== A remote attacker is able to execute arbitrary code on the host by providing a maliciously-crafted media file to VLC. References ========== https://www.videolan.org/security/sa1901.html https://hackerone.com/reports/484398 https://git.videolan.org/?p=vlc.git;a=commit;h=81023659c7de5ac2637b4a879195e... https://security.archlinux.org/CVE-2019-5439 https://security.archlinux.org/CVE-2019-12874