Off-by-One Error in VideoLAN VLC Media Player Affecting Image Handling
CVE-2019-19721

7.8HIGH

Key Information:

Vendor
Videolan
Status
Vlc Media Player
Vendor
CVE Published:
15 May 2020

Summary

An off-by-one error exists in the DecodeBlock function within the codec/sdl_image.c file of VideoLAN's VLC media player, versions prior to 3.0.9. This flaw allows malicious actors to exploit crafted image files to trigger memory corruption, leading to potential denial of service. Users of affected versions are advised to update their software to mitigate risks associated with this vulnerability.

References

https://www.videolan.org/security/
x_refsource_MISC
http://hg.libsdl.org/SDL_image/
x_refsource_MISC
https://bugs.gentoo.org/721940
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.