It also reports a problem in MP4 files and gives a CVS score of 6.8 for the Denial Of ServiceOverflow. Which is contrary to the above message in the National Vulnerability Database. There you can find the text for CVE-2019-13602:Īn Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted. However, I came across this entry, which might relativize it. The error occurs after my interpretation when opening and decoding MKV files. VideoLAN VLC media player 3.0.7.1 has a heap-based buffer over-read in mkv::demux_sys_t::FreeUnused() in modules/demux/mkv/demux.cpp when called from mkv::Open in modules/demux/mkv/mkv.cpp.Ī heap buffer overflow occurs there in the MKV module, so that read pointers can point to external memories. The National Vulnerability Database (NVD) classifies the vulnerability with a 9.8 base score as critical. However, there is no updated version of the VLC Player higher than version 3.0.7.1. Unfortunately, BürgerCERT recommends the timely installation of the security updates provided by the manufacturer in order to close the vulnerabilities. The BSI refers to this security focus entry, which reported a VideoLAN VLC CVE-2019-13602 Heap Based Buffer Overflow Vulnerability for all VLC Player versions as of June 14, 2019. A modified file must be opened to exploit the vulnerability. A remote, anonymous attacker can exploit a vulnerability in VLC to crash the program.

German BSI (Bundesamt für Sicherheit in der Informationstechnologie) warns within this document about a critical Denial of Service vulnerability in all VLC player versions up to v3.0.7.1. The VLC Media Player is available for Windows, macOS, Linux, Android etc. It is available for free on the Video LAN website and is quite popular. VLC Media Player is a program for playback of multimedia files and network streams.

Videolan vlc player