mykola/freebsd-ports
1
0
Fork 0
forked from Lainports/freebsd-ports
Code Pull requests Activity

Document two vulnerabilities in vlc < 3.0.7.1, potential remote exploit

Browse source
This commit is contained in:
Thomas Zander 2019-06-20 15:54:14 +00:00
parent 22e6feb769
commit e4b710fa3c
1 changed files with 57 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

57
security/vuxml/vuln.xml
View file

@ -58,6 +58,63 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="5b218581-9372-11e9-8fc4-5404a68ad561">
<topic>vlc -- Double free in Matroska demuxer</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>3.0.7.1,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The VLC project reports:</p>
<blockquote cite="http://git.videolan.org/?p=vlc.git;a=commit;h=81023659c7de5ac2637b4a879195efef50846102">
<p>mkv: Fix potential double free</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-12874</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12874</url>
<url>http://git.videolan.org/?p=vlc.git;a=commit;h=81023659c7de5ac2637b4a879195efef50846102</url>
</references>
<dates>
<discovery>2019-05-20</discovery>
<entry>2019-06-20</entry>
</dates>
</vuln>
<vuln vid="f2144530-936f-11e9-8fc4-5404a68ad561">
<topic>vlc -- Buffer overflow vulnerability</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>3.0.7,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>zhangyang reports:</p>
<blockquote cite="https://hackerone.com/reports/484398">
<p>The ReadFrame function in the avi.c file uses a variable i_width_bytes,
which is obtained directly from the file. It is a signed integer.
It does not do a strict check before the memory operation(memmove, memcpy),
which may cause a buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-5439</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5439</url>
<url>https://hackerone.com/reports/484398</url>
</references>
<dates>
<discovery>2019-01-23</discovery>
<entry>2019-06-20</entry>
</dates>
</vuln>
<vuln vid="0cea6e0a-7a39-4dac-b3ec-dbc13d404f76">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>