CVE-2019-14438: High severity Videolan VLC Media Player vulnerability
A heap-based buffer over-read in xiphPackHeaders() in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer over-read via a crafted .ogg file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vlcto a version that resolves this vulnerability.Fixed in 3.0.23-0+deb12u1Fixed in 3.0.23-0+deb13u1Fixed in 3.0.24-0+deb13u1Fixed in 3.0.24-3
Event History
Frequently Asked Questions
What is CVE-2019-14438?
CVE-2019-14438 is a vulnerability in VideoLAN VLC media player 3.0.7.1 that allows remote attackers to trigger a heap-based buffer over-read via a crafted .ogg file.
What is the severity of CVE-2019-14438?
CVE-2019-14438 has a severity score of 7.8 (high).
How can CVE-2019-14438 be exploited?
CVE-2019-14438 can be exploited by sending a crafted .ogg file to the vulnerable VLC media player.
Which software versions are affected by CVE-2019-14438?
CVE-2019-14438 affects VideoLAN VLC media player 3.0.7.1.
How can I fix CVE-2019-14438?
To fix CVE-2019-14438, update your VLC media player to version 3.0.8-0ubuntu18.04.1 or higher.