Paper/Archive/CVE-2019-12874

CVE-2019-12874

mitre — An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7.

EPSS 2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 84.0.840 × 2016.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while parsing a malformed MKV file type, has a double free.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgit.videolan.org/?p=vlc.git%3Ba=commit%3Bh=81023659c7de5ac2637b4a879195efef50846102 refsecurityfocus.com/bid/108882 advisoryusn.ubuntu.com/4074-1 advisorylists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html advisorylists.opensuse.org/opensuse-security-announce/2019-08/msg00040.html advisorylists.opensuse.org/opensuse-security-announce/2019-08/msg00037.html advisorysecurity.gentoo.org/glsa/201908-23 advisorylists.opensuse.org/opensuse-security-announce/2019-08/msg00081.html