CVE-2019-13962

תיאור (מקור, אנגלית)

lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.

מדדים

CVSS 3.1

9.8 (CRITICAL) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — סבירות ניצול

4% (אחוזון 100) נכון ל-14/10/2026

CWE

CWE-125

מוצרים מושפעים

videolan: vlc media player; opensuse: backports sle; opensuse: leap; debian: debian linux; canonical: ubuntu linux

קישורים

• https://trac.videolan.org/vlc/ticket/22240 ExploitVendor Advisory
• https://trac.videolan.org/vlc/ticket/22240 ExploitVendor Advisory
• http://git.videolan.org/?p=vlc/vlc-3.0.git%3Ba=commit%3Bh=2b4f9d0b0e0861f262c9‮…
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html Mailing ListThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00037.html Mailing ListThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00040.html Mailing ListThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00081.html Mailing ListThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html Mailing ListThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html Mailing ListThird Party Advisory
• http://www.securityfocus.com/bid/109306 Broken Link