MGASA-2021-0227
Updated vlc packages fix security vulnerabilities
A remote user could create a specifically crafted file that could trigger some various issues.
It is possible to trigger a remote code execution through a specifically crafted playlist, and tricking the user into interacting with that playlist elements.
It is also possible to trigger read or write buffer overflows with some crafted files or by a MITM attack on the automatic updater
If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user.
We updated VLC to latest version available.
What each source reports
OSV No score
Updated vlc packages fix security vulnerabilities
A remote user could create a specifically crafted file that could trigger some various issues.
It is possible to trigger a remote code execution through a specifically crafted playlist, and tricking the user into interacting with that playlist elements.
It is also possible to trigger read or write buffer overflows with some crafted files or by a MITM attack on the automatic updater
If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user.
We updated VLC to latest version available.
- Record
MGASA-2021-0227- Updated
- 2026-11-02
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
MGASA-2021-0227 is a vulnerability with no CVSS score yet in vlc, published June 8, 2021. No source lists public exploit code. Fixed in vlc 3.0.14-1.mga7.
References
advisories.mageia.org/MGASA-2021-0227.html
bugs.mageia.org/show_bug.cgi?id=28930
videolan.org/security/sb-vlc3013.html
code.videolan.org/videolan/vlc-3.0/-/raw/master/NEWS
git.videolan.org?p=vlc/vlc-3.0.git;a=blob;f=NEWS;h=e5dd1855e797179ec3a0bee2cae4ac68705a70cc;hb=41878ff4f2a4b566cf0a1bd15f72037b2be98a18