CVE-2019-13962

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-13962
lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://git.videolan.org/?p=vlc/vlc-3.0.git%3Ba=commit%3Bh=2b4f9d0b0e0861f262c90e9b9b94e7d53b864509
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00037.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00040.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00081.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html Mailing List Third Party Advisory
http://www.securityfocus.com/bid/109306 Broken Link
https://seclists.org/bugtraq/2019/Aug/36 Mailing List Third Party Advisory
https://security.gentoo.org/glsa/201909-02 Third Party Advisory
https://trac.videolan.org/vlc/ticket/22240 Exploit Vendor Advisory
https://usn.ubuntu.com/4131-1/ Third Party Advisory
https://www.debian.org/security/2019/dsa-4504 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:videolan:vlc_media_player:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*
cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
History

07 Nov 2023, 03:04

Type Values Removed Values Added
References
  • {'url': 'http://git.videolan.org/?p=vlc/vlc-3.0.git;a=commit;h=2b4f9d0b0e0861f262c90e9b9b94e7d53b864509', 'name': 'http://git.videolan.org/?p=vlc/vlc-3.0.git;a=commit;h=2b4f9d0b0e0861f262c90e9b9b94e7d53b864509', 'tags': ['Mailing List', 'Patch', 'Vendor Advisory'], 'refsource': 'MISC'}
  • () http://git.videolan.org/?p=vlc/vlc-3.0.git%3Ba=commit%3Bh=2b4f9d0b0e0861f262c90e9b9b94e7d53b864509 -

18 Apr 2022, 17:00

Type Values Removed Values Added
First Time Opensuse backports Sle
Debian debian Linux
Debian
Opensuse leap
Canonical ubuntu Linux
Canonical
Opensuse
CPE cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html - (SUSE) http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html - Mailing List, Third Party Advisory
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html - (SUSE) http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html - Mailing List, Third Party Advisory
References (GENTOO) https://security.gentoo.org/glsa/201909-02 - (GENTOO) https://security.gentoo.org/glsa/201909-02 - Third Party Advisory
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html - (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html - Mailing List, Third Party Advisory
References (BUGTRAQ) https://seclists.org/bugtraq/2019/Aug/36 - (BUGTRAQ) https://seclists.org/bugtraq/2019/Aug/36 - Mailing List, Third Party Advisory
References (UBUNTU) https://usn.ubuntu.com/4131-1/ - (UBUNTU) https://usn.ubuntu.com/4131-1/ - Third Party Advisory
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00037.html - (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00037.html - Mailing List, Third Party Advisory
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00081.html - (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00081.html - Mailing List, Third Party Advisory
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00040.html - (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00040.html - Mailing List, Third Party Advisory
References (BID) http://www.securityfocus.com/bid/109306 - Third Party Advisory, VDB Entry (BID) http://www.securityfocus.com/bid/109306 - Broken Link
References (DEBIAN) https://www.debian.org/security/2019/dsa-4504 - (DEBIAN) https://www.debian.org/security/2019/dsa-4504 - Third Party Advisory
Information

Published : 2019-07-18 20:15

Updated : 2023-12-10 12:59

NVD link : CVE-2019-13962

Mitre link : CVE-2019-13962

CVE.ORG link : CVE-2019-13962

JSON object : View

Products Affected

videolan

  • vlc_media_player

canonical

  • ubuntu_linux

opensuse

  • leap
  • backports_sle

debian

  • debian_linux
CWE
CWE-125

Out-of-bounds Read