CVE-2020-13428: Buffer Overflow
First published: Mon Jun 08 2020(Updated: )
A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/vlc | 3.0.17.4-0+deb10u1 3.0.17.4-0+deb10u2 3.0.18-0+deb11u1 3.0.18-2 3.0.19-1 | |
| Videolan Vlc Media Player | <3.0.11 | |
| Videolan Vlc Media Player | <3.0.11 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/videolan/vlc-3.0/releases/tag/3.0.11
- https://git.videolan.org/?p=vlc/vlc-3.0.git;a=commit;h=d5c43c21c747ff30ed19fcca745dea3481c733e0
- https://security-tracker.debian.org/tracker/CVE-2020-13428
- http://git.videolan.org/?p=vlc/vlc-3.0.git;a=commit;h=d5c43c21c747ff30ed19fcca745dea3481c733e0
- https://github.com/videolan/vlc/commits/master/modules/packetizer/hxxx_nal.c
- https://www.debian.org/security/2020/dsa-4704
- https://www.videolan.org/security/sb-vlc3011.html
Frequently Asked Questions
What is CVE-2020-13428?
CVE-2020-13428 is a heap-based buffer overflow vulnerability in the hxxx_AnnexB_to_xVC function in VLC media player before 3.0.11 for macOS/iOS.
How does CVE-2020-13428 affect VLC media player?
CVE-2020-13428 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code by exploiting the vulnerability.
Which versions of VLC media player are affected by CVE-2020-13428?
VLC media player versions before 3.0.11 for macOS/iOS are affected by CVE-2020-13428.
How can I fix CVE-2020-13428?
To fix CVE-2020-13428, update VLC media player to version 3.0.11 or later.
Where can I find more information about CVE-2020-13428?
More information about CVE-2020-13428 can be found in the references provided: [link1], [link2], [link3].
- collector/security-tracker-debian
- collector/nvd-index
- package-manager/debian
- vendor/videolan
- canonical/videolan vlc media player
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0