{"id":"CVE-2019-13602","aliases":["ALPINE-CVE-2019-13602","DEBIAN-CVE-2019-13602","DSA-4504-1","EUVD-2019-5041","GHSA-q4r3-mqq6-78x5","MGASA-2019-0233","UBUNTU-CVE-2019-13602","USN-4074-1","openSUSE-SU-2019:1840-1","openSUSE-SU-2019:1897-1","openSUSE-SU-2019:1909-1","openSUSE-SU-2019:2015-1","openSUSE-SU-2020:0545-1","openSUSE-SU-2020:0562-1","openSUSE-SU-2024:11502-1"],"status":"published","title":"An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media...","description":"An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0209,"percentile":0.81766,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-191","CWE-787"],"published":"2019-07-14T00:00:00Z","modified":"2026-11-03T06:31:49Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"vlc","fixed_in":["3.0.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"vlc","fixed_in":["3.0.7.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"vlc","fixed_in":["3.0.7.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"vlc","fixed_in":["3.0.7.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"vlc","fixed_in":["3.0.7.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"vlc","fixed_in":["3.0.7.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"vlc","fixed_in":["3.0.7.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"vlc","fixed_in":["3.0.7.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"vlc","fixed_in":["3.0.7.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"vlc","fixed_in":["3.0.7.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"vlc","fixed_in":["3.0.7.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"vlc","fixed_in":["3.0.7.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"vlc","fixed_in":["3.0.7.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"vlc","fixed_in":["3.0.7.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"vlc","fixed_in":["3.0.7.1-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"vlc","fixed_in":["3.0.7.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vlc","fixed_in":["3.0.7.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vlc","fixed_in":["3.0.7.1-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"vlc","fixed_in":["3.0.7.1-0ubuntu18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-0+deb9u1"}]}],"versions":["2.2.6-1","2.2.6-1~deb9u1","2.2.6-2","2.2.6-3","2.2.6-4","2.2.6-5","2.2.6-6","2.2.7-1","2.2.7-1~deb8u1","2.2.7-1~deb9u1","2.2.8-1","2.2.8-2","3.0.0-1","3.0.0~rc1-1","3.0.0~rc1~20171206-1","3.0.0~rc1~20171210-1","3.0.0~rc1~20171210-2","3.0.0~rc2-1","3.0.0~rc2-2","3.0.0~rc4-1","3.0.0~rc4-2","3.0.0~rc4-3","3.0.0~rc5-1","3.0.0~rc6-1","3.0.0~rc7-1","3.0.0~rc7-2","3.0.0~rc8-1","3.0.1-1","3.0.1-2","3.0.1-3","3.0.2-0+deb9u1","3.0.2-1","3.0.2-1+0.riscv64.1","3.0.2-1+0.riscv64.2","3.0.3-1","3.0.3-1+0.riscv64.1","3.0.3-1+b1+0.riscv64.1","3.0.3-1-0+deb9u1","3.0.3-1-1","3.0.3-1-2","3.0.3-1-3","3.0.3-1-4","3.0.3-2","3.0.4-1","3.0.4-2","3.0.4-3","3.0.4-4","3.0.5-1","3.0.5-2","3.0.6-0+deb9u1","3.0.6-1","3.0.7-0+deb9u1","3.0.7-1","3.0.7.1-1","3.0.7.1-2","3.0.7.1-3"],"bundled":12},{"source":"osv","ecosystem":"Debian:10","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-0+deb10u1"}]}],"versions":["3.0.7-1","3.0.7.1-1","3.0.7.1-2","3.0.7.1-3"],"bundled":12},{"source":"osv","ecosystem":"Mageia:6","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-1.mga6"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:6","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.7-1.mga6"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:6","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-1.mga6.tainted"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:7","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-1.mga7"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:7","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-1.mga7.tainted"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-3","2.2.1-5","2.2.2-1","2.2.2-2","2.2.2-3","2.2.2-3build1","2.2.2-4","2.2.2-5","2.2.2-5ubuntu0.16.04.1","2.2.2-5ubuntu0.16.04.2","2.2.2-5ubuntu0.16.04.3","2.2.2-5ubuntu0.16.04.4","2.2.2-5ubuntu0.16.04.5+esm1","2.2.2-5ubuntu0.16.04.5+esm2","2.2.2-5ubuntu0.16.04.5+esm3","2.2.2-5ubuntu0.16.04.5+esm4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-0ubuntu18.04.1"}]}],"versions":["2.2.6-6","2.2.6-6build1","2.2.7-1","2.2.8-1","2.2.8-1ubuntu4","2.2.8-2","3.0.0~rc1-1ubuntu1","3.0.0~rc1-1ubuntu3","3.0.0~rc2-1ubuntu1","3.0.0~rc2-2ubuntu1","3.0.0~rc2-2ubuntu2","3.0.0~rc4-1ubuntu1","3.0.0~rc7-2ubuntu1","3.0.0~rc8-1ubuntu1","3.0.0-1ubuntu1","3.0.1-1ubuntu5","3.0.1-2ubuntu1","3.0.1-2ubuntu2","3.0.1-3","3.0.1-3build1","3.0.2-0ubuntu0.1","3.0.3-1-1ubuntu1","3.0.4-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-0ubuntu18.04.1"}]}],"versions":["2.2.6-6","2.2.6-6build1","2.2.7-1","2.2.8-1","2.2.8-1ubuntu4","2.2.8-2","3.0.0~rc1-1ubuntu1","3.0.0~rc1-1ubuntu3","3.0.0~rc2-1ubuntu1","3.0.0~rc2-2ubuntu1","3.0.0~rc2-2ubuntu2","3.0.0~rc4-1ubuntu1","3.0.0~rc7-2ubuntu1","3.0.0~rc8-1ubuntu1","3.0.0-1ubuntu1","3.0.1-1ubuntu5","3.0.1-2ubuntu1","3.0.1-2ubuntu2","3.0.1-3","3.0.1-3build1","3.0.2-0ubuntu0.1","3.0.3-1-1ubuntu1","3.0.4-1ubuntu0.2"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-lp151.6.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-bp151.5.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-lp150.2.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-lp150.8.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-bp150.2.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7.1-bp150.2.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-lp151.6.6.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-bp151.5.6.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-1.5"}]}],"bundled":17}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"opensuse","product":"backports_sle"},{"vendor":"opensuse","product":"leap"},{"vendor":"videolan","product":"vlc_media_player"}],"references":[{"url":"https://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=8e8e0d72447f8378244f5b4a3dcde036dbeb1491","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=b2b157076d9e94df34502dd8df0787deb940e938","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/109158","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","web"]},{"url":"https://usn.ubuntu.com/4074-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00040.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00037.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4504","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://seclists.org/bugtraq/2019/Aug/36","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00081.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201909-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13602"},{"url":"https://git.videolan.org/?p=vlc.git;a=commit;h=8e8e0d72447f8378244f5b4a3dcde036dbeb1491"},{"url":"https://git.videolan.org/?p=vlc.git;a=commit;h=b2b157076d9e94df34502dd8df0787deb940e938"},{"url":"https://usn.ubuntu.com/4074-1"},{"url":"https://github.com/advisories/GHSA-q4r3-mqq6-78x5"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-13602","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13602","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0233.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25284","tags":["report"]},{"url":"https://www.videolan.org/security/sb-vlc308.html","tags":["web"]},{"url":"https://www.videolan.org/developers/vlc-branch/NEWS","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-13602","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4074-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-5439","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12874","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5PABXAYOSN5GAIPFDYI7SHBOU4CHBWYC/#5PABXAYOSN5GAIPFDYI7SHBOU4CHBWYC","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1118586","tags":["report"]},{"url":"https://bugzilla.suse.com/1138354","tags":["report"]},{"url":"https://bugzilla.suse.com/1138933","tags":["report"]},{"url":"https://bugzilla.suse.com/1141522","tags":["report"]},{"url":"https://bugzilla.suse.com/1142161","tags":["report"]},{"url":"https://bugzilla.suse.com/1143547","tags":["report"]},{"url":"https://bugzilla.suse.com/1143549","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5460","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BZ6PVIORM3E3KCDWEJP6ZSJVHTRTXT2M/#BZ6PVIORM3E3KCDWEJP6ZSJVHTRTXT2M","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PV7IWMKNJKPD75QWP2SQJIG5DET23UDW/#PV7IWMKNJKPD75QWP2SQJIG5DET23UDW","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1093732","tags":["report"]},{"url":"https://bugzilla.suse.com/1094893","tags":["report"]},{"url":"https://bugzilla.suse.com/1133290","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RNBI5GJAXU5KVZYP22ZO47MDJGB63ZQK/#RNBI5GJAXU5KVZYP22ZO47MDJGB63ZQK","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SFHFURFW5IFIHSRDD3YMUC6GB232FD3U/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1146428","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14970","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ONU7H5UORTQ2UM2HDIPLR7AOGTPENU4H/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26664","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-13602","description":"An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.","status":"published","published":"2019-07-14T21:00:27Z","modified":"2026-10-08T21:13:53.251Z","updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2019-5041","description":"An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.","status":"published","published":"2019-07-14T21:00:27Z","modified":"2026-10-08T21:13:53Z","updated_at":"2026-11-02T17:27:26.452288Z"}],"ghsa":[{"id":"GHSA-q4r3-mqq6-78x5","title":"An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media...","description":"An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.","status":"published","published":"2022-05-24T16:50:13Z","modified":"2026-10-09T00:32:05Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-191","CWE-787"],"updated_at":"2026-11-02T15:12:59.31428Z"}],"nvd":[{"id":"CVE-2019-13602","description":"An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.","status":"published","published":"2019-07-14T21:15:11.217Z","modified":"2026-10-08T22:16:49.78Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-191","CWE-787"],"updated_at":"2026-11-02T14:05:19.195714Z"}],"osv":[{"id":"ALPINE-CVE-2019-13602","description":"An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.","status":"published","published":"2019-07-14T21:15:11.217Z","modified":"2026-11-03T06:31:49.853420418Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2019-13602","description":"An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.","status":"published","published":"2019-07-14T21:15:11.217Z","modified":"2026-10-24T10:30:24.157976968Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-13602","description":"An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.","status":"published","published":"2019-07-14T21:15:11.217Z","modified":"2026-10-09T09:47:23.368430291Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-13602","description":"An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.","status":"published","published":"2019-07-14T00:00:00Z","modified":"2026-04-22T12:10:22.210998Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DSA-4504-1","title":"vlc - security update","status":"published","published":"2019-08-20T00:00:00Z","modified":"2026-03-09T02:09:13.017362Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0233","title":"Updated vlc packages fixes security vulnerabilities","description":"Updated vlc packages fixes security vulnerabilities:\n\nMultiple security issues were discovered in the VLC media player, which\ncould result in the execution of arbitrary code or denial of service if\na malformed file/stream is processed (CVE-2019-13602, CVE-2019-13962,\nCVE-2019-14437, CVE-2019-14438, CVE-2019-14498, CVE-2019-14533,\nCVE-2019-14534, CVE-2019-14535, CVE-2019-14776, CVE-2019-14777,\nCVE-2019-14778, CVE-2019-14970).\n\nThe vlc package has been updated to version 3.0.8, fixing these issues and\nother bugs.  In Mageia 6, the libebml package has been updated to version\n1.3.7, which is needed for Matroska support.\n","status":"published","published":"2019-08-31T13:22:36Z","modified":"2026-04-16T04:40:41.69689087Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1840-1","title":"Security update for vlc","description":"This update for vlc to version 3.0.7.1 fixes the following issues:\n\nSecurity issues fixed:\n\t  \n- CVE-2019-5439: Fixed a buffer overflow (bsc#1138354).\n- CVE-2019-5459: Fixed an integer underflow (bsc#1143549).\n- CVE-2019-5460: Fixed a double free (bsc#1143547).\n- CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933).\n- CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522).\n- CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161).\n\nNon-security issues fixed:\n\n- Video Output:\n  * Fix hardware acceleration with some AMD drivers\n  * Improve direct3d11 HDR support\n- Access:\n  * Improve Blu-ray support\n- Audio output:\n  * Fix pass-through on Android-23\n  * Fix DirectSound drain\n- Demux: Improve MP4 support\n- Video Output:\n  * Fix 12 bits sources playback with Direct3D11\n  * Fix crash on iOS\n  * Fix midstream aspect-ratio changes when Windows hardware decoding is on\n  * Fix HLG display with Direct3D11\n- Stream Output: Improve Chromecast support with new ChromeCast apps\n- Misc:\n  * Update Youtube, Dailymotion, Vimeo, Soundcloud scripts\n  * Work around busy looping when playing an invalid item with loop enabled\n- Updated translations.\n","status":"published","published":"2019-08-08T15:58:05Z","modified":"2026-02-04T02:32:23.05348Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1897-1","title":"Security update for vlc","description":"This update for vlc to version 3.0.7.1 fixes the following issues:\n\nSecurity issues fixed:\n\t  \n- CVE-2019-5439: Fixed a buffer overflow (bsc#1138354).\n- CVE-2019-5459: Fixed an integer underflow (bsc#1143549).\n- CVE-2019-5460: Fixed a double free (bsc#1143547).\n- CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933).\n- CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522).\n- CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161).\n\nNon-security issues fixed:\n\n- Video Output:\n  * Fix hardware acceleration with some AMD drivers\n  * Improve direct3d11 HDR support\n- Access:\n  * Improve Blu-ray support\n- Audio output:\n  * Fix pass-through on Android-23\n  * Fix DirectSound drain\n- Demux: Improve MP4 support\n- Video Output:\n  * Fix 12 bits sources playback with Direct3D11\n  * Fix crash on iOS\n  * Fix midstream aspect-ratio changes when Windows hardware decoding is on\n  * Fix HLG display with Direct3D11\n- Stream Output: Improve Chromecast support with new ChromeCast apps\n- Misc:\n  * Update Youtube, Dailymotion, Vimeo, Soundcloud scripts\n  * Work around busy looping when playing an invalid item with loop enabled\n- Updated translations.\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2019-08-15T08:55:15Z","modified":"2026-02-04T02:57:01.53514Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1909-1","title":"Security update for vlc","description":"This update for vlc to version 3.0.7.1 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-5439: Fixed a buffer overflow (bsc#1138354).\n- CVE-2019-5459: Fixed an integer underflow (bsc#1143549).\n- CVE-2019-5460: Fixed a double free (bsc#1143547).\n- CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933).\n- CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522).\n- CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161).\n\nNon-security issues fixed:\n\n- Video Output:\n  * Fix hardware acceleration with some AMD drivers\n  * Improve direct3d11 HDR support\n- Access:\n  * Improve Blu-ray support\n- Audio output:\n  * Fix pass-through on Android-23\n  * Fix DirectSound drain\n- Demux: Improve MP4 support\n- Video Output:\n  * Fix 12 bits sources playback with Direct3D11\n  * Fix crash on iOS\n  * Fix midstream aspect-ratio changes when Windows hardware decoding is on\n  * Fix HLG display with Direct3D11\n- Stream Output: Improve Chromecast support with new ChromeCast apps\n- Misc:\n  * Update Youtube, Dailymotion, Vimeo, Soundcloud scripts\n  * Work around busy looping when playing an invalid item with loop enabled\n- Updated translations.\n\nNew package libaom:\n  * Initial version 1.0.0\n  * A library for AOMedia Video 1 (AV1), an open, royalty-free video coding format\n    designed for video transmissions over the Internet.\n\n","status":"published","published":"2019-08-15T09:44:57Z","modified":"2026-02-04T02:58:33.498572Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2015-1","title":"Security update for vlc","description":"This update for vlc to version 3.0.7.1 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-5439: Fixed a buffer overflow (bsc#1138354).\n- CVE-2019-5459: Fixed an integer underflow (bsc#1143549).\n- CVE-2019-5460: Fixed a double free (bsc#1143547).\n- CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933).\n- CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522).\n- CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161).\n\nNon-security issues fixed:\n\n- Video Output:\n  * Fix hardware acceleration with some AMD drivers\n  * Improve direct3d11 HDR support\n- Access:\n  * Improve Blu-ray support\n- Audio output:\n  * Fix pass-through on Android-23\n  * Fix DirectSound drain\n- Demux: Improve MP4 support\n- Video Output:\n  * Fix 12 bits sources playback with Direct3D11\n  * Fix crash on iOS\n  * Fix midstream aspect-ratio changes when Windows hardware decoding is on\n  * Fix HLG display with Direct3D11\n- Stream Output: Improve Chromecast support with new ChromeCast apps\n- Misc:\n  * Update Youtube, Dailymotion, Vimeo, Soundcloud scripts\n  * Work around busy looping when playing an invalid item with loop enabled\n- Updated translations.\n\nNew package libaom:\n  * Initial version 1.0.0\n  * A library for AOMedia Video 1 (AV1), an open, royalty-free video coding format\n    designed for video transmissions over the Internet.\n\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-08-26T14:22:46Z","modified":"2026-02-04T03:52:51.375083Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2020:0545-1","title":"Security update for vlc","description":"This update for vlc fixes the following issues:\n\nvlc was updated to version 3.0.9.2:\n\n+ Misc: Properly bump the version in configure.ac.\n\nChanges from version 3.0.9.1:\n\n+ Misc: Fix VLSub returning 401 for earch request.\n\nChanges from version 3.0.9:\n\n+ Core: Work around busy looping when playing an invalid item\n  through VLM.\n+ Access:\n  * Multiple dvdread and dvdnav crashs fixes\n  * Fixed DVD glitches on clip change\n  * Fixed dvdread commands/data sequence inversion in some cases causing\n    unwanted glitches\n  * Better handling of authored as corrupted DVD\n  * Added libsmb2 support for SMB2/3 shares\n+ Demux:\n  * Fix TTML entities not passed to decoder\n  * Fixed some WebVTT styling tags being not applied\n  * Misc raw H264/HEVC frame rate fixes\n  * Fix adaptive regression on TS format change (mostly HLS)\n  * Fixed MP4 regression with twos/sowt PCM audio\n  * Fixed some MP4 raw quicktime and ms-PCM audio\n  * Fixed MP4 interlacing handling\n  * Multiple adaptive stack (DASH/HLS/Smooth) fixes\n  * Enabled Live seeking for HLS\n  * Fixed seeking in some cases for HLS\n  * Improved Live playback for Smooth and DASH\n  * Fixed adaptive unwanted end of stream in some cases\n  * Faster adaptive start and new buffering control options\n+ Packetizers:\n  * Fixes H264/HEVC incomplete draining in some cases\n  * packetizer_helper: Fix potential trailing junk on last packet\n  * Added missing drain in packetizers that was causing missing\n    last frame or audio\n  * Improved check to prevent fLAC synchronization drops\n+ Decoder:\n  * avcodec: revector video decoder to fix incomplete drain\n  * spudec: implemented palette updates, fixing missing subtitles\n    on some DVD\n  * Fixed WebVTT CSS styling not being applied on Windows/macOS\n  * Fixed Hebrew teletext pages support in zvbi\n  * Fixed Dav1d aborting decoding on corrupted picture\n  * Extract and display of all CEA708 subtitles\n  * Update libfaad to 2.9.1\n  * Add DXVA support for VP9 Profile 2 (10 bits)\n  * Mediacodec aspect ratio with Amazon devices\n+ Audio output:\n  * Added support for iOS audiounit audio above 48KHz\n  * Added support for amem audio up to 384KHz\n+ Video output:\n  * Fix for opengl glitches in some drivers\n  * Fix GMA950 opengl support on macOS\n  * YUV to RGB StretchRect fixes with NVIDIA drivers\n  * Use libpacebo new tone mapping desaturation algorithm\n+ Text renderer:\n  * Fix crashes on macOS with SSA/ASS subtitles containing emoji\n  * Fixed unwanted growing background in Freetype rendering and Y padding\n+ Mux: Fixed some YUV mappings\n+ Service Discovery: Update libmicrodns to 0.1.2.\n+ Misc:\n  * Update YouTube, SoundCloud and Vocaroo scripts: this restores\n    playback of YouTube URLs.\n  * Add missing .wpl \u0026 .zpl file associations on Windows\n  * Improved chromecast audio quality\n\nUpdate to version 3.0.8 'vetinari':\n\n+ Fix stuttering for low framerate videos\n+ Improve adaptive streaming\n+ Improve audio output for external audio devices on macOS/iOS\n+ Fix hardware acceleration with Direct3D11 for some AMD drivers\n+ Fix WebVTT subtitles rendering\n+ Vetinari is a major release changing a lot in the media engine of VLC.\n  It is one of the largest release we've ever done.\n  Notably, it:\n   - activates hardware decoding on all platforms, of H.264 \u0026 H.265, 8 \u0026 10bits,\n     allowing 4K60 or even 8K decoding with little CPU consumption,\n   - merges all the code from the mobile ports into the same codebase with\n     common numbering and releases,\n   - supports 360 video and 3D audio, and prepares for VR content,\n   - supports direct HDR and HDR tone-mapping,\n   - updates the audio passthrough for HD Audio codecs,\n   - allows browsing of local network drives like SMB, FTP, SFTP, NFS...\n   - stores the passwords securely,\n   - brings a new subtitle rendering engine, supporting ComplexTextLayout\n     and font fallback to support multiple languages and fonts,\n   - supports ChromeCast with the new renderer framework,\n   - adds support for numerous new formats and codecs, including WebVTT,\n     AV1, TTML, HQX, 708, Cineform, and many more,\n   - improves Bluray support with Java menus, aka BD-J,\n   - updates the macOS interface with major cleaning and improvements,\n   - support HiDPI UI on Windows, with the switch to Qt5,\n   - prepares the experimental support for Wayland on Linux, and\n     switches to OpenGL by default on Linux.\n+ Security fixes included:\n  * Fix a buffer overflow in the MKV demuxer (CVE-2019-14970)\n  * Fix a read buffer overflow in the avcodec decoder (CVE-2019-13962)\n  * Fix a read buffer overflow in the FAAD decoder\n  * Fix a read buffer overflow in the OGG demuxer (CVE-2019-14437, CVE-2019-14438)\n  * Fix a read buffer overflow in the ASF demuxer (CVE-2019-14776)\n  * Fix a use after free in the MKV demuxer (CVE-2019-14777, CVE-2019-14778)\n  * Fix a use after free in the ASF demuxer (CVE-2019-14533)\n  * Fix a couple of integer underflows in the MP4 demuxer (CVE-2019-13602)\n  * Fix a null dereference in the dvdnav demuxer\n  * Fix a null dereference in the ASF demuxer (CVE-2019-14534)\n  * Fix a null dereference in the AVI demuxer\n  * Fix a division by zero in the CAF demuxer (CVE-2019-14498)\n  * Fix a division by zero in the ASF demuxer (CVE-2019-14535)\n- Disbale mod-plug for the time being: libmodplug 0.8.9 is not yet available.\n\n- Disable SDL_image (SDL 1.2) based codec. It is only a wrapper around some\n  image loading libraries (libpng, libjpeg, ...) which are either wrapped\n  by vlc itself (libpng_plugin.so) or via libavcodec (libavcodec_plugin.so).\n","status":"published","published":"2020-04-23T08:12:41Z","modified":"2026-02-04T04:12:53.134389Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0562-1","title":"Security update for vlc","description":"This update for vlc fixes the following issues:\n\nvlc was updated to version 3.0.9.2:\n\n+ Misc: Properly bump the version in configure.ac.\n\nChanges from version 3.0.9.1:\n\n+ Misc: Fix VLSub returning 401 for earch request.\n\nChanges from version 3.0.9:\n\n+ Core: Work around busy looping when playing an invalid item\n  through VLM.\n+ Access:\n  * Multiple dvdread and dvdnav crashs fixes\n  * Fixed DVD glitches on clip change\n  * Fixed dvdread commands/data sequence inversion in some cases causing\n    unwanted glitches\n  * Better handling of authored as corrupted DVD\n  * Added libsmb2 support for SMB2/3 shares\n+ Demux:\n  * Fix TTML entities not passed to decoder\n  * Fixed some WebVTT styling tags being not applied\n  * Misc raw H264/HEVC frame rate fixes\n  * Fix adaptive regression on TS format change (mostly HLS)\n  * Fixed MP4 regression with twos/sowt PCM audio\n  * Fixed some MP4 raw quicktime and ms-PCM audio\n  * Fixed MP4 interlacing handling\n  * Multiple adaptive stack (DASH/HLS/Smooth) fixes\n  * Enabled Live seeking for HLS\n  * Fixed seeking in some cases for HLS\n  * Improved Live playback for Smooth and DASH\n  * Fixed adaptive unwanted end of stream in some cases\n  * Faster adaptive start and new buffering control options\n+ Packetizers:\n  * Fixes H264/HEVC incomplete draining in some cases\n  * packetizer_helper: Fix potential trailing junk on last packet\n  * Added missing drain in packetizers that was causing missing\n    last frame or audio\n  * Improved check to prevent fLAC synchronization drops\n+ Decoder:\n  * avcodec: revector video decoder to fix incomplete drain\n  * spudec: implemented palette updates, fixing missing subtitles\n    on some DVD\n  * Fixed WebVTT CSS styling not being applied on Windows/macOS\n  * Fixed Hebrew teletext pages support in zvbi\n  * Fixed Dav1d aborting decoding on corrupted picture\n  * Extract and display of all CEA708 subtitles\n  * Update libfaad to 2.9.1\n  * Add DXVA support for VP9 Profile 2 (10 bits)\n  * Mediacodec aspect ratio with Amazon devices\n+ Audio output:\n  * Added support for iOS audiounit audio above 48KHz\n  * Added support for amem audio up to 384KHz\n+ Video output:\n  * Fix for opengl glitches in some drivers\n  * Fix GMA950 opengl support on macOS\n  * YUV to RGB StretchRect fixes with NVIDIA drivers\n  * Use libpacebo new tone mapping desaturation algorithm\n+ Text renderer:\n  * Fix crashes on macOS with SSA/ASS subtitles containing emoji\n  * Fixed unwanted growing background in Freetype rendering and Y padding\n+ Mux: Fixed some YUV mappings\n+ Service Discovery: Update libmicrodns to 0.1.2.\n+ Misc:\n  * Update YouTube, SoundCloud and Vocaroo scripts: this restores\n    playback of YouTube URLs.\n  * Add missing .wpl \u0026 .zpl file associations on Windows\n  * Improved chromecast audio quality\n\nUpdate to version 3.0.8 'vetinari':\n\n+ Fix stuttering for low framerate videos\n+ Improve adaptive streaming\n+ Improve audio output for external audio devices on macOS/iOS\n+ Fix hardware acceleration with Direct3D11 for some AMD drivers\n+ Fix WebVTT subtitles rendering\n+ Vetinari is a major release changing a lot in the media engine of VLC.\n  It is one of the largest release we've ever done.\n  Notably, it:\n   - activates hardware decoding on all platforms, of H.264 \u0026 H.265, 8 \u0026 10bits,\n     allowing 4K60 or even 8K decoding with little CPU consumption,\n   - merges all the code from the mobile ports into the same codebase with\n     common numbering and releases,\n   - supports 360 video and 3D audio, and prepares for VR content,\n   - supports direct HDR and HDR tone-mapping,\n   - updates the audio passthrough for HD Audio codecs,\n   - allows browsing of local network drives like SMB, FTP, SFTP, NFS...\n   - stores the passwords securely,\n   - brings a new subtitle rendering engine, supporting ComplexTextLayout\n     and font fallback to support multiple languages and fonts,\n   - supports ChromeCast with the new renderer framework,\n   - adds support for numerous new formats and codecs, including WebVTT,\n     AV1, TTML, HQX, 708, Cineform, and many more,\n   - improves Bluray support with Java menus, aka BD-J,\n   - updates the macOS interface with major cleaning and improvements,\n   - support HiDPI UI on Windows, with the switch to Qt5,\n   - prepares the experimental support for Wayland on Linux, and\n     switches to OpenGL by default on Linux.\n+ Security fixes included:\n  * Fix a buffer overflow in the MKV demuxer (CVE-2019-14970)\n  * Fix a read buffer overflow in the avcodec decoder (CVE-2019-13962)\n  * Fix a read buffer overflow in the FAAD decoder\n  * Fix a read buffer overflow in the OGG demuxer (CVE-2019-14437, CVE-2019-14438)\n  * Fix a read buffer overflow in the ASF demuxer (CVE-2019-14776)\n  * Fix a use after free in the MKV demuxer (CVE-2019-14777, CVE-2019-14778)\n  * Fix a use after free in the ASF demuxer (CVE-2019-14533)\n  * Fix a couple of integer underflows in the MP4 demuxer (CVE-2019-13602)\n  * Fix a null dereference in the dvdnav demuxer\n  * Fix a null dereference in the ASF demuxer (CVE-2019-14534)\n  * Fix a null dereference in the AVI demuxer\n  * Fix a division by zero in the CAF demuxer (CVE-2019-14498)\n  * Fix a division by zero in the ASF demuxer (CVE-2019-14535)\n- Disbale mod-plug for the time being: libmodplug 0.8.9 is not yet available.\n\n- Disable SDL_image (SDL 1.2) based codec. It is only a wrapper around some\n  image loading libraries (libpng, libjpeg, ...) which are either wrapped\n  by vlc itself (libpng_plugin.so) or via libavcodec (libavcodec_plugin.so).\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2020-04-29T06:03:33Z","modified":"2026-02-04T03:49:37.474266Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11502-1","title":"libvlc5-3.0.16-1.5 on GA media","description":"These are all security issues fixed in the libvlc5-3.0.16-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:48:02.043281Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"USN-4074-1","title":"vlc vulnerabilities","description":"It was discovered that the VLC CAF demuxer incorrectly handled certain\nfiles. If a user were tricked into opening a specially-crafted CAF file, a\nremote attacker could use this issue to cause VLC to crash, resulting in a\ndenial of service. This issue only affected Ubuntu 18.04 LTS.\n(CVE-2018-19857)\n\nIt was discovered that the VLC Matroska demuxer incorrectly handled certain\nfiles. If a user were tricked into opening a specially-crafted MKV file, a\nremote attacker could use this issue to cause VLC to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2019-12874)\n\nIt was discovered that the VLC MP4 demuxer incorrectly handled certain\nfiles. If a user were tricked into opening a specially-crafted MP4 file, a\nremote attacker could use this issue to cause VLC to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2019-13602)\n\nIt was discovered that the VLC AVI demuxer incorrectly handled certain\nfiles. If a user were tricked into opening a specially-crafted AVI file, a\nremote attacker could use this issue to cause VLC to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2019-5439)\n","status":"published","published":"2019-07-25T11:57:08Z","modified":"2026-04-27T15:27:12.116884Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}