The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly. As a result, a heap-based buffer over-read can be triggered via a crafted .ogg file.

This update for vlc fixes the following issues :

vlc was updated to version 3.0.9.2 :

  + Misc: Properly bump the version in configure.ac.

Changes from version 3.0.9.1 :

  + Misc: Fix VLSub returning 401 for earch request.

Changes from version 3.0.9 :

  + Core: Work around busy looping when playing an invalid     item through VLM.

  + Access :

  - Multiple dvdread and dvdnav crashs fixes

  - Fixed DVD glitches on clip change

  - Fixed dvdread commands/data sequence inversion in some     cases causing unwanted glitches

  - Better handling of authored as corrupted DVD

  - Added libsmb2 support for SMB2/3 shares

  + Demux :

  - Fix TTML entities not passed to decoder

  - Fixed some WebVTT styling tags being not applied

  - Misc raw H264/HEVC frame rate fixes

  - Fix adaptive regression on TS format change (mostly HLS)

  - Fixed MP4 regression with twos/sowt PCM audio

  - Fixed some MP4 raw quicktime and ms-PCM audio

  - Fixed MP4 interlacing handling

  - Multiple adaptive stack (DASH/HLS/Smooth) fixes

  - Enabled Live seeking for HLS

  - Fixed seeking in some cases for HLS

  - Improved Live playback for Smooth and DASH

  - Fixed adaptive unwanted end of stream in some cases

  - Faster adaptive start and new buffering control options

  + Packetizers :

  - Fixes H264/HEVC incomplete draining in some cases

  - packetizer_helper: Fix potential trailing junk on last     packet

  - Added missing drain in packetizers that was causing     missing last frame or audio

  - Improved check to prevent fLAC synchronization drops

  + Decoder :

  - avcodec: revector video decoder to fix incomplete drain

  - spudec: implemented palette updates, fixing missing     subtitles on some DVD

  - Fixed WebVTT CSS styling not being applied on     Windows/macOS

  - Fixed Hebrew teletext pages support in zvbi

  - Fixed Dav1d aborting decoding on corrupted picture

  - Extract and display of all CEA708 subtitles

  - Update libfaad to 2.9.1

  - Add DXVA support for VP9 Profile 2 (10 bits)

  - Mediacodec aspect ratio with Amazon devices

  + Audio output :

  - Added support for iOS audiounit audio above 48KHz

  - Added support for amem audio up to 384KHz

  + Video output :

  - Fix for opengl glitches in some drivers

  - Fix GMA950 opengl support on macOS

  - YUV to RGB StretchRect fixes with NVIDIA drivers

  - Use libpacebo new tone mapping desaturation algorithm

  + Text renderer :

  - Fix crashes on macOS with SSA/ASS subtitles containing     emoji

  - Fixed unwanted growing background in Freetype rendering     and Y padding

  + Mux: Fixed some YUV mappings

  + Service Discovery: Update libmicrodns to 0.1.2.

  + Misc :

  - Update YouTube, SoundCloud and Vocaroo scripts: this     restores playback of YouTube URLs.

  - Add missing .wpl & .zpl file associations on Windows

  - Improved chromecast audio quality

Update to version 3.0.8 'vetinari' :

  + Fix stuttering for low framerate videos

  + Improve adaptive streaming

  + Improve audio output for external audio devices on     macOS/iOS

  + Fix hardware acceleration with Direct3D11 for some AMD     drivers

  + Fix WebVTT subtitles rendering

  + Vetinari is a major release changing a lot in the media     engine of VLC. It is one of the largest release we've     ever done. Notably, it :

  - activates hardware decoding on all platforms, of H.264 &     H.265, 8 & 10bits, allowing 4K60 or even 8K decoding     with little CPU consumption,

  - merges all the code from the mobile ports into the same     codebase with common numbering and releases,

  - supports 360 video and 3D audio, and prepares for VR     content,

  - supports direct HDR and HDR tone-mapping,

  - updates the audio passthrough for HD Audio codecs,

  - allows browsing of local network drives like SMB, FTP,     SFTP, NFS...

  - stores the passwords securely,

  - brings a new subtitle rendering engine, supporting     ComplexTextLayout and font fallback to support multiple     languages and fonts,

  - supports ChromeCast with the new renderer framework,

  - adds support for numerous new formats and codecs,     including WebVTT, AV1, TTML, HQX, 708, Cineform, and     many more,

  - improves Bluray support with Java menus, aka BD-J,

  - updates the macOS interface with major cleaning and     improvements,

  - support HiDPI UI on Windows, with the switch to Qt5,

  - prepares the experimental support for Wayland on Linux,     and switches to OpenGL by default on Linux.

  + Security fixes included :

  - Fix a buffer overflow in the MKV demuxer     (CVE-2019-14970)

  - Fix a read buffer overflow in the avcodec decoder     (CVE-2019-13962)

  - Fix a read buffer overflow in the FAAD decoder

  - Fix a read buffer overflow in the OGG demuxer     (CVE-2019-14437, CVE-2019-14438)

  - Fix a read buffer overflow in the ASF demuxer     (CVE-2019-14776)

  - Fix a use after free in the MKV demuxer (CVE-2019-14777,     CVE-2019-14778)

  - Fix a use after free in the ASF demuxer (CVE-2019-14533)

  - Fix a couple of integer underflows in the MP4 demuxer     (CVE-2019-13602)

  - Fix a null dereference in the dvdnav demuxer

  - Fix a null dereference in the ASF demuxer     (CVE-2019-14534)

  - Fix a null dereference in the AVI demuxer

  - Fix a division by zero in the CAF demuxer     (CVE-2019-14498)

  - Fix a division by zero in the ASF demuxer     (CVE-2019-14535)

  - Disbale mod-plug for the time being: libmodplug 0.8.9 is     not yet available.

  - Disable SDL_image (SDL 1.2) based codec. It is only a     wrapper around some image loading libraries (libpng,     libjpeg, ...) which are either wrapped by vlc itself     (libpng_plugin.so) or via libavcodec     (libavcodec_plugin.so).

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4131-1 advisory.

    It was discovered that VLC incorrectly handled certain media files. If a user were tricked into opening a     specially-crafted file, a remote attacker could use this issue to cause VLC to crash, resulting in a     denial of service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201909-02 (VLC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VLC. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The version of VLC media player installed on the remote Windows host is prior to 3.0.8. It is, therefore, affected by multiple vulnerabilities:

  - An integer underflow condition exists in the modules/demux/mp4/mp4.c component of VLC Player. An unauthenticated,     remote attacker can exploit this, by supplying a crafted mp4 file, to cause a denial of service condition or the     execution of arbitrary code (CVE-2019-13602).

  - A heap-based buffer overflow condition exists in the modules/codec/avcodec/video.c component of VLC Player due to     improper sanitization of the width and height values. A remote attacker can exploit this, by supplying a specially     crafted video file, to cause a denial of service condition or the execution of arbitrary code (CVE-2019-13962).

  - A NULL pointer de-reference flaw exists in the ASF Demuxer component of VLC Player. An unauthenticated, remote     attacker can exploit this, by supplying crafted input, to cause a denial of service condition when the application     attempts to read or write memory with a NULL pointer (CVE-2019-14534).

Multiple security issues were discovered in the VLC media player, which could result in the execution of arbitrary code or denial of service if a malformed file/stream is processed.

The VLC project reports :

Security : * Fix a buffer overflow in the MKV demuxer (CVE-2019-14970)
* Fix a read buffer overflow in the avcodec decoder (CVE-2019-13962) * Fix a read buffer overflow in the FAAD decoder * Fix a read buffer overflow in the OGG demuxer (CVE-2019-14437, CVE-2019-14438) * Fix a read buffer overflow in the ASF demuxer (CVE-2019-14776) * Fix a use after free in the MKV demuxer (CVE-2019-14777, CVE-2019-14778) * Fix a use after free in the ASF demuxer (CVE-2019-14533) * Fix a couple of integer underflows in the MP4 demuxer (CVE-2019-13602) * Fix a null dereference in the dvdnav demuxer * Fix a null dereference in the ASF demuxer (CVE-2019-14534) * Fix a null dereference in the AVI demuxer * Fix a division by zero in the CAF demuxer (CVE-2019-14498) * Fix a division by zero in the ASF demuxer (CVE-2019-14535)

ID	Name	Product	Family	Severity
136008	openSUSE Security Update : vlc (openSUSE-2020-545)	Nessus	SuSE Local Security Checks	critical
128756	Ubuntu 18.04 LTS : VLC vulnerabilities (USN-4131-1)	Nessus	Ubuntu Local Security Checks	critical
128591	GLSA-201909-02 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
128080	VLC < 3.0.8 Multiple Vulnerabilities	Nessus	Windows	critical
128066	Debian DSA-4504-1 : vlc - security update	Nessus	Debian Local Security Checks	critical
128042	FreeBSD : vlc -- multiple vulnerabilities (795442e7-c355-11e9-8224-5404a68ad561)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2019-14437

high

Tenable Plugins

critical

critical

critical

critical

critical

critical