CVE-2020-26664: Buffer Overflow
First published: Fri Jan 08 2021(Updated: )
A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/vlc | 3.0.17.4-0+deb10u1 3.0.17.4-0+deb10u2 3.0.18-0+deb11u1 3.0.18-2 3.0.19-1 | |
| Videolan Vlc Media Player | <3.0.12 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| debian/vlc | <=3.0.11-0+deb10u1<=3.0.11.1-3 | 3.0.12-1 3.0.12-0+deb10u1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://code.videolan.org/videolan/vlc-3.0/-/commit/ec1f55ee9ace5cc675395a1bc9700d99679e7e8c
- https://gist.githubusercontent.com/henices/db11664dd45b9f322f8514d182aef5ea/raw/d56940c8bf211992bf4f3309a85bb2b69383e511/CVE-2020-26664.txt
- https://security-tracker.debian.org/tracker/CVE-2020-26664
- http://videolan.com
- http://vlc.com
- https://lists.debian.org/debian-lts-announce/2022/06/msg00012.html
- https://security.gentoo.org/glsa/202101-37
- https://www.debian.org/security/2021/dsa-4834
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=979676
Frequently Asked Questions
What is the severity of CVE-2020-26664?
The severity of CVE-2020-26664 is high with a CVSS score of 7.8.
How does CVE-2020-26664 affect VideoLAN VLC media player?
CVE-2020-26664 allows attackers to trigger a heap-based buffer overflow in VideoLAN VLC media player 3.0.11.
How can I exploit CVE-2020-26664?
To exploit CVE-2020-26664, attackers need to use a crafted .mkv file.
What is the remediation for CVE-2020-26664 in Debian Debian Linux 10.0?
To remediate CVE-2020-26664 in Debian Debian Linux 10.0, update the VLC package to version 3.0.19-1 or later.
Where can I find more information about CVE-2020-26664?
For more information about CVE-2020-26664, you can refer to the following references: [1](https://security-tracker.debian.org/tracker/CVE-2020-26664), [2](https://code.videolan.org/videolan/vlc-3.0/-/commit/ec1f55ee9ace5cc675395a1bc9700d99679e7e8c), [3](https://gist.githubusercontent.com/henices/db11664dd45b9f322f8514d182aef5ea/raw/d56940c8bf211992bf4f3309a85bb2b69383e511/CVE-2020-26664.txt)
- collector/security-tracker-debian
- collector/nvd-index
- collector/debian-bugs
- alias/CVE-2020-26664
- package-manager/debian
- vendor/videolan
- canonical/videolan vlc media player
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0