CVE-2019-19721CWE-193CWE-787

CVE-2019-19721

High · published May 15, 2020

CVSS v3.1
7.8
EPSS
2%
Percentile
80.4
In the wild
Unconfirmed
What it is

An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01982 · 80.4th percentile
Weaknesses
CWE-193 · Off-by-one Error; CWE-787 · Out-of-bounds Write
Published
2020-05-15T22:15Z
Affected products (1)
ProductVersionsFixed in
videolan/vlc_media_player< 3.0.93.0.9
References (8)
http://hg.libsdl.org/SDL_image/ · [email protected]https://bugs.gentoo.org/721940 · [email protected]https://git.videolan.org/?p=vlc/vlc-3.0.git%3Ba=commit%3Bh=72afe7ebd8305bf4f5360293b8621cde52ec506b · [email protected]https://www.videolan.org/security/ · [email protected]http://hg.libsdl.org/SDL_image/ · af854a3a-2127-422b-91ae-364da2661108https://bugs.gentoo.org/721940 · af854a3a-2127-422b-91ae-364da2661108https://git.videolan.org/?p=vlc/vlc-3.0.git%3Ba=commit%3Bh=72afe7ebd8305bf4f5360293b8621cde52ec506b · af854a3a-2127-422b-91ae-364da2661108https://www.videolan.org/security/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 15 MAY 17:28Z
    An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of…
    cvelistv5