CVE-2019-14970: Buffer Overflow
A vulnerability in mkv::eventthreadt in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer overflow via a crafted .mkv file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vlcto a version that resolves this vulnerability.Fixed in 3.0.23-0+deb12u1Fixed in 3.0.23-0+deb13u1Fixed in 3.0.24-0+deb13u1Fixed in 3.0.24-3
Event History
Frequently Asked Questions
What is CVE-2019-14970?
CVE-2019-14970 is a vulnerability in mkv::event_thread_t in VideoLAN VLC media player 3.0.7.1.
How does CVE-2019-14970 affect the VLC media player?
CVE-2019-14970 allows remote attackers to trigger a heap-based buffer overflow via a crafted .mkv file.
Which versions of VLC media player are affected by CVE-2019-14970?
VLC media player 3.0.7.1 is affected by CVE-2019-14970.
How severe is CVE-2019-14970?
CVE-2019-14970 has a severity rating of 7.8 (high).
How can I fix the CVE-2019-14970 vulnerability?
To fix the CVE-2019-14970 vulnerability, update VLC media player to version 3.0.8-0ubuntu18.04.1 (for Ubuntu) or apply the appropriate security patches for your OS.