CVE-2019-14498: Divide by Zero
A divide-by-zero error exists in the Control function of demux/caf.c in VideoLAN VLC media player 3.0.7.1. As a result, an FPE can be triggered via a crafted CAF file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vlcto a version that resolves this vulnerability.Fixed in 3.0.23-0+deb12u1Fixed in 3.0.23-0+deb13u1Fixed in 3.0.24-0+deb13u1Fixed in 3.0.24-3
Event History
Frequently Asked Questions
What is CVE-2019-14498?
CVE-2019-14498 is a vulnerability in the Control function of demux/caf.c in VideoLAN VLC media player 3.0.7.1 that allows a divide-by-zero error to be triggered via a crafted CAF file.
What is the severity of CVE-2019-14498?
CVE-2019-14498 has a severity level of 7.8 (high).
How does CVE-2019-14498 impact VLC media player?
CVE-2019-14498 can trigger a divide-by-zero error in the Control function of demux/caf.c in VLC media player 3.0.7.1 when processing a specially crafted CAF file.
Which versions of VLC media player are affected by CVE-2019-14498?
VLC media player version 3.0.7.1 is affected by CVE-2019-14498.
How can I remediate CVE-2019-14498 in VLC media player?
To remediate CVE-2019-14498, update VLC media player to version 3.0.8 or higher.