CVE-2018-19937: Medium severity vlc media player vulnerability

Q: What is CVE-2018-19937?

CVE-2018-19937 is a vulnerability in the VideoLAN VLC media player app for iOS that allows a local authenticated attacker to bypass the passcode by opening a URL and turning the phone.

Q: How can an attacker exploit CVE-2018-19937?

An attacker with local authentication can exploit CVE-2018-19937 by opening a URL and turning the phone to bypass the passcode in the VLC media player app for iOS.

Q: What is the severity level of CVE-2018-19937?

CVE-2018-19937 has a severity level of medium with a CVSS score of 6.6.

Q: Which version of the VideoLAN VLC media player app for iOS is affected by CVE-2018-19937?

CVE-2018-19937 affects versions of the VideoLAN VLC media player app for iOS before 3.1.5.

Q: Is there a fix available for CVE-2018-19937?

Yes, upgrading to version 3.1.5 of the VideoLAN VLC media player app for iOS will fix CVE-2018-19937.

Published Dec 31, 2018

Updated

A local, authenticated attacker can bypass the passcode in the VideoLAN VLC media player app before 3.1.5 for iOS by opening a URL and turning the phone.

Affected Software

1 affected component

Videolan Vlc For Mobile Iphone Os<3.1.5

Remediation

Patch Available

https://github.com/videolan/vlc-ios/pull/178/commits/d84d7c0a94eb7fba202d2c5fc3739276d2d3986f

Event History

Dec 31, 2018

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is CVE-2018-19937?

CVE-2018-19937 is a vulnerability in the VideoLAN VLC media player app for iOS that allows a local authenticated attacker to bypass the passcode by opening a URL and turning the phone.

How can an attacker exploit CVE-2018-19937?

An attacker with local authentication can exploit CVE-2018-19937 by opening a URL and turning the phone to bypass the passcode in the VLC media player app for iOS.

What is the severity level of CVE-2018-19937?