CVE-2019-14437

The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly. As a result, a heap-based buffer over-read can be triggered via a crafted .ogg file.

References

Affected packages

Git / github.com/videolan/vlc-3.0

Affected ranges

Type

GIT

Repo

https://github.com/videolan/vlc-3.0

Events

Introduced

Last affected

f3940db4af197ba7218e604dd0a6733654015770

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.7.1"
        }
    ]
}

Affected versions

0.*

0.9.0

0.9.0-test0

0.9.0-test1

0.9.0-test2

0.9.0-test3

1.*

1.0.0-pre1

1.0.0-pre2

1.0.0-rc1

1.1.0-ff

1.1.0-pre1

1.2.0-pre1

1.3.0-git

2.*

2.1.0-git

2.2.0-git

3.*

3.0.0

3.0.0-1

3.0.0-2

3.0.0-git

3.0.0-rc1

3.0.0-rc2

3.0.0-rc3

3.0.0-rc4

3.0.0-rc5

3.0.0-rc6

3.0.0-rc7

3.0.0-rc8

3.0.0.1

3.0.1

3.0.2

3.0.3

3.0.3-1

3.0.4

3.0.5

3.0.5-1

3.0.5-2

3.0.6

3.0.7

3.0.7.1

Other

svn-trunk

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-14437.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0"
            }
        ]
    }
]