[manjaro-security] [ASA-201906-22] vlc: arbitrary code execution
foxboron at archlinux.org
Mon Jul 1 21:00:44 CEST 2019
Arch Linux Security Advisory ASA-201906-22
Date : 2019-06-25
CVE-ID : CVE-2019-5439 CVE-2019-12874
Package : vlc
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-998
The package vlc before version 220.127.116.11-1 is vulnerable to arbitrary
Upgrade to 18.104.22.168-1.
# pacman -Syu "vlc>=22.214.171.124-1"
The problems have been fixed upstream in version 126.96.36.199.
- CVE-2019-5439 (arbitrary code execution)
VideoLAN VLC media player 3.0.6 and earlier has a out-of-bounds write
has been found in the ReadFrame function of the AVI decoder.
- CVE-2019-12874 (arbitrary code execution)
VideoLAN VLC media player 3.0.6 and earlier has a double-free in the
zlib_decompress_extra function of the Matroska demuxer in
A remote attacker is able to execute arbitrary code on the host by
providing a maliciously-crafted media file to VLC.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the manjaro-security