Stories
Slash Boxes
Comments

SoylentNews is people

Flaws Allow Hacking a System Playing Untrusted Videos on VLC Player

posted by martyb on Tuesday June 25 2019, @11:08PM   Printer-friendly
from the no-more-playing-around dept.

MrPlow writes:

Submitted via IRC for SoyCow1944

An attacker could remotely take full control over a computer system while playing untrusted videos with any version of VLC media player software prior to 3.0.7.

The hack is possible due to two high-risk security flaws (CVE-2019-5439, CVE-2019-12874) that could potentially lead to arbitrary code execution attacks. The company Videolan also addressed many other medium and low-severity security vulnerabilities in its software.

"A remote user can create some specially crafted avi or mkv files that, when loaded by the target user, will trigger a heap buffer overflow (read) in ReadFrame (demux/avi/avi.c), or a double free in zlib_decompress_extra() (demux/mkv/utils.cpp) respectively" reads the security advisory published by the company. "If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user."

Source: https://securityaffairs.co/wordpress/87433/breaking-news/vlc-player-flaws.html

Original Submission

 
This discussion has been archived. No new comments can be posted.
Flaws Allow Hacking a System Playing Untrusted Videos on VLC Player | Log In/Create an Account | Top | 17 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 0) by Anonymous Coward on Wednesday June 26 2019, @12:22PM (1 child)

    by Anonymous Coward on Wednesday June 26 2019, @12:22PM (#860058)

    Forget Ubuntu. Switch to Fedora. VLC 3.0.7.1 here. Directly from rpmfusion repos.

  • (Score: 2) by JoeMerchant on Thursday June 27 2019, @02:47AM

    by JoeMerchant (3937) on Thursday June 27 2019, @02:47AM (#860359)

    I think that's a difference between apt/deb and yum/rpm, mostly.

    I tried living with CentOS for over a year, about a year ago... didn't enjoy it much - not impossible, just more trouble overall than in Ubuntu.

    --
    🌻🌻 [google.com]