Vulnerability · Published Jun 8, 2020 · Assigned by mitre
CVE-2020-13428
High 7.8
In plain English
A high-severity security flaw in the vlc package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.8High
Exploit odds (30 days)2.5%top 15.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | vlc | 3.0.11-r0 | ALPINE-CVE-2020-13428 |
| Alpine:v3.21 | vlc | 3.0.11-r0 | ALPINE-CVE-2020-13428 |
| Alpine:v3.22 | vlc | 3.0.11-r0 | ALPINE-CVE-2020-13428 |
| Alpine:v3.23 | vlc | 3.0.11-r0 | ALPINE-CVE-2020-13428 |
| Alpine:v3.24 | vlc | 3.0.11-r0 | ALPINE-CVE-2020-13428 |
| Debian:12 | vlc | 3.0.11-1 | DEBIAN-CVE-2020-13428 |
| Debian:13 | vlc | 3.0.11-1 | DEBIAN-CVE-2020-13428 |
| Debian:14 | vlc | 3.0.11-1 | DEBIAN-CVE-2020-13428 |
Affected products (as reported)
References
- https://github.com/videolan/vlc/commits/master/modules/packetizer/hxxx_nal.c x_refsource_MISC
- http://git.videolan.org/?p=vlc/vlc-3.0.git%3Ba=commit%3Bh=d5c43c21c747ff30ed19fcca745dea3481c733e0 x_refsource_MISC
- https://github.com/videolan/vlc-3.0/releases/tag/3.0.11 x_refsource_CONFIRM
- DSA-4704 vendor-advisory, x_refsource_DEBIAN
- https://www.videolan.org/security/sb-vlc3011.html x_refsource_CONFIRM