PublicDateAtUSN: 2019-08-29
Candidate: CVE-2019-14438
PublicDate: 2019-08-29 18:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14438
 https://www.videolan.org/security/sb-vlc308.html
 https://ubuntu.com/security/notices/USN-4131-1
Description:
 A heap-based buffer over-read in xiph_PackHeaders() in modules/demux/xiph.h
 in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a
 heap-based buffer over-read via a crafted .ogg file.
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by: Antonio Morales from the Semmle Security Team
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H [7.8 HIGH]


Patches_vlc:
upstream_vlc: released (3.0.8-1)
precise/esm_vlc: DNE
trusty_vlc: ignored (out of standard support)
trusty/esm_vlc: DNE
xenial_vlc: ignored (end of standard support, was needed)
bionic_vlc: released (3.0.8-0ubuntu18.04.1)
disco_vlc: released (3.0.8-0ubuntu19.04.1)
eoan_vlc: not-affected (3.0.8-2)
focal_vlc: not-affected (3.0.8-2)
groovy_vlc: not-affected (3.0.8-2)
hirsute_vlc: not-affected (3.0.8-2)
impish_vlc: not-affected (3.0.8-2)
jammy_vlc: not-affected (3.0.8-2)
devel_vlc: not-affected (3.0.8-2)