CVE-2020-13428

Опубликовано: 08 июн. 2020

Источник: nvd

CVSS3: 7.8

CVSS2: 6.8

EPSS Низкий

Описание

A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.

Ссылки

http://git.videolan.org/?p=vlc/vlc-3.0.git%3Ba=commit%3Bh=d5c43c21c747ff30ed19fcca745dea3481c733e0
https://github.com/videolan/vlc-3.0/releases/tag/3.0.11
Release Notes
Third Party Advisory
https://github.com/videolan/vlc/commits/master/modules/packetizer/hxxx_nal.c
Patch
Third Party Advisory
https://www.debian.org/security/2020/dsa-4704
Third Party Advisory
https://www.videolan.org/security/sb-vlc3011.html
Vendor Advisory
http://git.videolan.org/?p=vlc/vlc-3.0.git%3Ba=commit%3Bh=d5c43c21c747ff30ed19fcca745dea3481c733e0
https://github.com/videolan/vlc-3.0/releases/tag/3.0.11
Release Notes
Third Party Advisory
https://github.com/videolan/vlc/commits/master/modules/packetizer/hxxx_nal.c
Patch
Third Party Advisory
https://www.debian.org/security/2020/dsa-4704
Third Party Advisory
https://www.videolan.org/security/sb-vlc3011.html
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:videolan:vlc_media_player:*:*:*:*:*:iphone_os:*:*

Версия до 3.0.11 (исключая)

cpe:2.3:a:videolan:vlc_media_player:*:*:*:*:*:macos:*:*

Версия до 3.0.11 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

EPSS

Процентиль: 91%

0.0692

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-787

Связанные уязвимости

CVE-2020-13428

CVSS3: 7.8

ubuntu

больше 5 лет назад

CVE-2020-13428

CVSS3: 7.8

debian

больше 5 лет назад

A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in mod ...

GHSA-2cf7-9933-4jgc

CVSS3: 7.8

github

больше 3 лет назад

A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player through 3.2.8 for iOS, and through 3.0.10 for macOS, allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.

BDU:2020-03597

CVSS3: 6.3

fstec

больше 5 лет назад

Уязвимость функции hxxx_AnnexB_to_xVC() программы-медиапроигрывателя Videolan VLC, позволяющая нарушителю выполнить произвольный код

openSUSE-SU-2021:0091-1

suse-cvrf

около 5 лет назад

Security update for vlc

EPSS

Процентиль: 91%

0.0692

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-787