Arch Linux Security Advisory ASA-201906-22

Severity: Critical
Date : 2019-06-25
CVE-ID : CVE-2019-5439 CVE-2019-12874
Package : vlc
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-998

Summary

The package vlc before version 3.0.7.1-1 is vulnerable to arbitrary
code execution.

Resolution

Upgrade to 3.0.7.1-1.

pacman -Syu “vlc>=3.0.7.1-1”

The problems have been fixed upstream in version 3.0.7.1.

Workaround

None.

Description

• CVE-2019-5439 (arbitrary code execution)

VideoLAN VLC media player 3.0.6 and earlier has a out-of-bounds write
has been found in the ReadFrame function of the AVI decoder.

• CVE-2019-12874 (arbitrary code execution)

VideoLAN VLC media player 3.0.6 and earlier has a double-free in the
zlib_decompress_extra function of the Matroska demuxer in
modules/demux/mkv/util.cpp.

Impact

A remote attacker is able to execute arbitrary code on the host by
providing a maliciously-crafted media file to VLC.

References

https://www.videolan.org/security/sa1901.html
https://hackerone.com/reports/484398
https://git.videolan.org/?p=vlc.git;a=commit;h=81023659c7de5ac2637b4a879195efef50846102
https://security.archlinux.org/CVE-2019-5439
https://security.archlinux.org/CVE-2019-12874