PublicDateAtUSN: 2019-07-18
Candidate: CVE-2019-13962
PublicDate: 2019-07-18 20:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13962
 https://ubuntu.com/security/notices/USN-4131-1
Description:
 lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media
 player through 3.0.7 has a heap-based buffer over-read because it does not
 properly validate the width and height.
Ubuntu-Description:
Notes:
Bugs:
 https://trac.videolan.org/vlc/ticket/22240
Priority: low
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]


Patches_vlc:
 upstream: http://git.videolan.org/?p=vlc/vlc-3.0.git;a=commit;h=2b4f9d0b0e0861f262c90e9b9b94e7d53b864509
upstream_vlc: released (3.0.8)
precise/esm_vlc: DNE
trusty_vlc: ignored (out of standard support)
trusty/esm_vlc: DNE
xenial_vlc: ignored (end of standard support, was needed)
bionic_vlc: released (3.0.8-0ubuntu18.04.1)
disco_vlc: released (3.0.8-0ubuntu19.04.1)
eoan_vlc: not-affected (3.0.8-2)
focal_vlc: not-affected (3.0.8-2)
groovy_vlc: not-affected (3.0.8-2)
hirsute_vlc: not-affected (3.0.8-2)
impish_vlc: not-affected (3.0.8-2)
jammy_vlc: not-affected (3.0.8-2)
devel_vlc: not-affected (3.0.8-2)