The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer when processing magic cookies in CAF files, because a ReadKukiChunk() cast converts a return value to an unsigned int even if that value is negative. This could result in a denial of service and/or a potential infoleak.

The version of VLC media player installed on the remote host with version 3.0.4.  It is, therefore, affected by a denial of service and/or a potential infoleak vulnerability. (CVE-2018-19857).

This update for vlc to version 3.0.7.1 fixes the following issues :

Security issues fixed :

  - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354).

  - CVE-2019-5459: Fixed an integer underflow (bsc#1143549).

  - CVE-2019-5460: Fixed a double free (bsc#1143547).

  - CVE-2019-12874: Fixed a double free in     zlib_decompress_extra in modules/demux/mkv/util.cpp     (bsc#1138933).

  - CVE-2019-13602: Fixed an integer underflow in mp4     demuxer (boo#1141522).

  - CVE-2019-13962: Fixed a heap-based buffer over-read in     avcodec (boo#1142161).

Non-security issues fixed :

  - Video Output :

  - Fix hardware acceleration with some AMD drivers

  - Improve direct3d11 HDR support

  - Access :

  - Improve Blu-ray support

  - Audio output :

  - Fix pass-through on Android-23

  - Fix DirectSound drain

  - Demux: Improve MP4 support

  - Video Output :

  - Fix 12 bits sources playback with Direct3D11

  - Fix crash on iOS

  - Fix midstream aspect-ratio changes when Windows hardware     decoding is on

  - Fix HLG display with Direct3D11

  - Stream Output: Improve Chromecast support with new     ChromeCast apps

  - Misc :

  - Update Youtube, Dailymotion, Vimeo, Soundcloud scripts

  - Work around busy looping when playing an invalid item     with loop enabled

  - Updated translations.

New package libaom :

  - Initial version 1.0.0

  - A library for AOMedia Video 1 (AV1), an open,     royalty-free video coding format designed for video     transmissions over the Internet.

This update for vlc to version 3.0.7.1 fixes the following issues :

Security issues fixed :

&#9; - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354).

  - CVE-2019-5459: Fixed an integer underflow (bsc#1143549).

  - CVE-2019-5460: Fixed a double free (bsc#1143547).

  - CVE-2019-12874: Fixed a double free in     zlib_decompress_extra in modules/demux/mkv/util.cpp     (bsc#1138933).

  - CVE-2019-13602: Fixed an integer underflow in mp4     demuxer (boo#1141522).

  - CVE-2019-13962: Fixed a heap-based buffer over-read in     avcodec (boo#1142161).

Non-security issues fixed :

  - Video Output :

  - Fix hardware acceleration with some AMD drivers

  - Improve direct3d11 HDR support

  - Access :

  - Improve Blu-ray support

  - Audio output :

  - Fix pass-through on Android-23

  - Fix DirectSound drain

  - Demux: Improve MP4 support

  - Video Output :

  - Fix 12 bits sources playback with Direct3D11

  - Fix crash on iOS

  - Fix midstream aspect-ratio changes when Windows hardware     decoding is on

  - Fix HLG display with Direct3D11

  - Stream Output: Improve Chromecast support with new     ChromeCast apps

  - Misc :

  - Update Youtube, Dailymotion, Vimeo, Soundcloud scripts

  - Work around busy looping when playing an invalid item     with loop enabled

  - Updated translations.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4074-1 advisory.

    It was discovered that the VLC CAF demuxer incorrectly handled certain files. If a user were tricked into     opening a specially-crafted CAF file, a remote attacker could use this issue to cause VLC to crash,     resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-19857)

    It was discovered that the VLC Matroska demuxer incorrectly handled certain files. If a user were tricked     into opening a specially-crafted MKV file, a remote attacker could use this issue to cause VLC to crash,     resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-12874)

    It was discovered that the VLC MP4 demuxer incorrectly handled certain files. If a user were tricked into     opening a specially-crafted MP4 file, a remote attacker could use this issue to cause VLC to crash,     resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-13602)

    It was discovered that the VLC AVI demuxer incorrectly handled certain files. If a user were tricked into     opening a specially-crafted AVI file, a remote attacker could use this issue to cause VLC to crash,     resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-5439)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An integer underflow was discovered in the CAF demuxer of the VLC media player.

ID	Name	Product	Family	Severity
136895	VLC < 3.0.5 Denial of Service and/or Infoleak Vulnerability	Nessus	Windows	critical
128001	openSUSE Security Update : vlc (openSUSE-2019-1909)	Nessus	SuSE Local Security Checks	critical
127743	openSUSE Security Update : vlc (openSUSE-2019-1840)	Nessus	SuSE Local Security Checks	critical
127095	Ubuntu 18.04 LTS : VLC vulnerabilities (USN-4074-1)	Nessus	Ubuntu Local Security Checks	critical
121135	Debian DSA-4366-1 : vlc - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2018-19857

critical

Tenable Plugins

critical

critical

critical

critical

critical