An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while parsing a malformed MKV file type, has a double free.

This update for vlc to version 3.0.7.1 fixes the following issues :

Security issues fixed :

  - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354).

  - CVE-2019-5459: Fixed an integer underflow (bsc#1143549).

  - CVE-2019-5460: Fixed a double free (bsc#1143547).

  - CVE-2019-12874: Fixed a double free in     zlib_decompress_extra in modules/demux/mkv/util.cpp     (bsc#1138933).

  - CVE-2019-13602: Fixed an integer underflow in mp4     demuxer (boo#1141522).

  - CVE-2019-13962: Fixed a heap-based buffer over-read in     avcodec (boo#1142161).

Non-security issues fixed :

  - Video Output :

  - Fix hardware acceleration with some AMD drivers

  - Improve direct3d11 HDR support

  - Access :

  - Improve Blu-ray support

  - Audio output :

  - Fix pass-through on Android-23

  - Fix DirectSound drain

  - Demux: Improve MP4 support

  - Video Output :

  - Fix 12 bits sources playback with Direct3D11

  - Fix crash on iOS

  - Fix midstream aspect-ratio changes when Windows hardware     decoding is on

  - Fix HLG display with Direct3D11

  - Stream Output: Improve Chromecast support with new     ChromeCast apps

  - Misc :

  - Update Youtube, Dailymotion, Vimeo, Soundcloud scripts

  - Work around busy looping when playing an invalid item     with loop enabled

  - Updated translations.

New package libaom :

  - Initial version 1.0.0

  - A library for AOMedia Video 1 (AV1), an open,     royalty-free video coding format designed for video     transmissions over the Internet.

The remote host is affected by the vulnerability described in GLSA-201908-23 (VLC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VLC. Please review the       CVE identifiers referenced below for details.
  Impact :

    Remote attackers, by enticing a user to execute a specially crafted       media file, could cause a Denial of Service condition or possibly execute       arbitrary code.
  Workaround :

    There is no known workaround at this time.

This update for vlc to version 3.0.7.1 fixes the following issues :

Security issues fixed :

&#9; - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354).

  - CVE-2019-5459: Fixed an integer underflow (bsc#1143549).

  - CVE-2019-5460: Fixed a double free (bsc#1143547).

  - CVE-2019-12874: Fixed a double free in     zlib_decompress_extra in modules/demux/mkv/util.cpp     (bsc#1138933).

  - CVE-2019-13602: Fixed an integer underflow in mp4     demuxer (boo#1141522).

  - CVE-2019-13962: Fixed a heap-based buffer over-read in     avcodec (boo#1142161).

Non-security issues fixed :

  - Video Output :

  - Fix hardware acceleration with some AMD drivers

  - Improve direct3d11 HDR support

  - Access :

  - Improve Blu-ray support

  - Audio output :

  - Fix pass-through on Android-23

  - Fix DirectSound drain

  - Demux: Improve MP4 support

  - Video Output :

  - Fix 12 bits sources playback with Direct3D11

  - Fix crash on iOS

  - Fix midstream aspect-ratio changes when Windows hardware     decoding is on

  - Fix HLG display with Direct3D11

  - Stream Output: Improve Chromecast support with new     ChromeCast apps

  - Misc :

  - Update Youtube, Dailymotion, Vimeo, Soundcloud scripts

  - Work around busy looping when playing an invalid item     with loop enabled

  - Updated translations.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4074-1 advisory.

    It was discovered that the VLC CAF demuxer incorrectly handled certain files. If a user were tricked into     opening a specially-crafted CAF file, a remote attacker could use this issue to cause VLC to crash,     resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-19857)

    It was discovered that the VLC Matroska demuxer incorrectly handled certain files. If a user were tricked     into opening a specially-crafted MKV file, a remote attacker could use this issue to cause VLC to crash,     resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-12874)

    It was discovered that the VLC MP4 demuxer incorrectly handled certain files. If a user were tricked into     opening a specially-crafted MP4 file, a remote attacker could use this issue to cause VLC to crash,     resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-13602)

    It was discovered that the VLC AVI demuxer incorrectly handled certain files. If a user were tricked into     opening a specially-crafted AVI file, a remote attacker could use this issue to cause VLC to crash,     resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-5439)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of VLC media player installed on the remote host is earlier than 3.0.7.  It is, therefore, affected by multiple vulnerabilities:

  - A heap-based buffer overflow condition exists in ReadFrame     due to improper parsing of AVI files. A remote attacker can     exploit this by tricking a user into opening a specially     crafted avi file to cause a denial of service condition     or the execution of arbitrary code.(CVE-2019-5439)

  - A double free vulnerability exists in zlib_decompress_extra     due to improper parsing of MKV files. A remote attacker can     exploit this by tricking a user into opening a specially     crafted MKV file to cause a denial of service condition     or the execution of arbitrary code.(CVE-2019-12874)

  - An Integer underflow in VLC Media Player versions < 3.0.7     leads to an out-of-band read..(CVE-2019-5459)

  - A double free vulnerability exists which lead to VLC application to crash.
    (CVE-2019-5460)

The VLC project reports :

mkv: Fix potential double free

ID	Name	Product	Family	Severity
128001	openSUSE Security Update : vlc (openSUSE-2019-1909)	Nessus	SuSE Local Security Checks	critical
127972	GLSA-201908-23 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
127743	openSUSE Security Update : vlc (openSUSE-2019-1840)	Nessus	SuSE Local Security Checks	critical
127095	Ubuntu 18.04 LTS : VLC vulnerabilities (USN-4074-1)	Nessus	Ubuntu Local Security Checks	critical
126246	VLC < 3.0.7 Multiple Vulnerabilities	Nessus	Windows	critical
126081	FreeBSD : vlc -- Double free in Matroska demuxer (5b218581-9372-11e9-8fc4-5404a68ad561)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2019-12874

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical