[ASA-201906-22] vlc: arbitrary code execution
foxboron at archlinux.org
Mon Jul 1 19:00:44 UTC 2019
Arch Linux Security Advisory ASA-201906-22
Date : 2019-06-25
CVE-ID : CVE-2019-5439 CVE-2019-12874
Package : vlc
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-998
The package vlc before version 18.104.22.168-1 is vulnerable to arbitrary
Upgrade to 22.214.171.124-1.
# pacman -Syu "vlc>=126.96.36.199-1"
The problems have been fixed upstream in version 188.8.131.52.
- CVE-2019-5439 (arbitrary code execution)
VideoLAN VLC media player 3.0.6 and earlier has a out-of-bounds write
has been found in the ReadFrame function of the AVI decoder.
- CVE-2019-12874 (arbitrary code execution)
VideoLAN VLC media player 3.0.6 and earlier has a double-free in the
zlib_decompress_extra function of the Matroska demuxer in
A remote attacker is able to execute arbitrary code on the host by
providing a maliciously-crafted media file to VLC.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the arch-security