{"id":"CVE-2020-6079","aliases":["ALPINE-CVE-2020-6079","DEBIAN-CVE-2020-6079","DSA-4671-1","EUVD-2020-27233","GHSA-484g-rjcp-74rc","MGASA-2020-0203","UBUNTU-CVE-2020-6079","USN-7239-1"],"status":"published","title":"An exploitable denial-of-service vulnerability exists in the resource allocation handling of...","description":"An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger this vulnerability through decoding of the domain name performed by rr_decode.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.03146,"percentile":0.88017,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-401"],"published":"2020-03-24T20:49:46Z","modified":"2026-11-03T06:32:31Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"vlc","fixed_in":["3.0.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"vlc","fixed_in":["3.0.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"vlc","fixed_in":["3.0.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"vlc","fixed_in":["3.0.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"vlc","fixed_in":["3.0.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"vlc","fixed_in":["3.0.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"vlc","fixed_in":["3.0.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"vlc","fixed_in":["3.0.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"vlc","fixed_in":["3.0.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"vlc","fixed_in":["3.0.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"vlc","fixed_in":["3.0.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"vlc","fixed_in":["3.0.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"vlc","fixed_in":["3.0.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"vlc","fixed_in":["3.0.9.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libmicrodns","fixed_in":["0.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libmicrodns","fixed_in":["0.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"vlc","fixed_in":["3.0.8-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vlc","fixed_in":["3.0.8-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vlc","fixed_in":["3.0.8-4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libmicrodns","fixed_in":["0.0.8-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vlc","fixed_in":["3.0.8-0ubuntu18.04.1+esm3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libmicrodns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libmicrodns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-4"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10-0+deb9u1"}]}],"versions":["2.2.6-1","2.2.6-1~deb9u1","2.2.6-2","2.2.6-3","2.2.6-4","2.2.6-5","2.2.6-6","2.2.7-1","2.2.7-1~deb8u1","2.2.7-1~deb9u1","2.2.8-1","2.2.8-2","3.0.0-1","3.0.0~rc1-1","3.0.0~rc1~20171206-1","3.0.0~rc1~20171210-1","3.0.0~rc1~20171210-2","3.0.0~rc2-1","3.0.0~rc2-2","3.0.0~rc4-1","3.0.0~rc4-2","3.0.0~rc4-3","3.0.0~rc5-1","3.0.0~rc6-1","3.0.0~rc7-1","3.0.0~rc7-2","3.0.0~rc8-1","3.0.1-1","3.0.1-2","3.0.1-3","3.0.2-0+deb9u1","3.0.2-1","3.0.2-1+0.riscv64.1","3.0.2-1+0.riscv64.2","3.0.3-1","3.0.3-1+0.riscv64.1","3.0.3-1+b1+0.riscv64.1","3.0.3-1-0+deb9u1","3.0.3-1-1","3.0.3-1-2","3.0.3-1-3","3.0.3-1-4","3.0.3-2","3.0.4-1","3.0.4-2","3.0.4-3","3.0.4-4","3.0.5-1","3.0.5-2","3.0.6-0+deb9u1","3.0.6-1","3.0.7-0+deb9u1","3.0.7-1","3.0.7.1-1","3.0.7.1-2","3.0.7.1-3","3.0.8-0+deb9u1","3.0.8-1","3.0.8-2","3.0.8-3","3.0.8-4","3.0.9.2-1"],"bundled":8},{"source":"osv","ecosystem":"Debian:10","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10-0+deb10u1"}]}],"versions":["3.0.7-1","3.0.7.1-1","3.0.7.1-2","3.0.7.1-3","3.0.8-0+deb10u1","3.0.8-1","3.0.8-2","3.0.8-3","3.0.8-4","3.0.9.2-1"],"bundled":8},{"source":"osv","ecosystem":"Mageia:7","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10-1.mga7"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:7","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10-1.mga7.tainted"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libmicrodns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.8-1ubuntu0.1~esm1"}]}],"versions":["0.0.7-2","0.0.8-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-0ubuntu18.04.1+esm3"}]}],"versions":["2.2.6-6","2.2.6-6build1","2.2.7-1","2.2.8-1","2.2.8-1ubuntu4","2.2.8-2","3.0.0~rc1-1ubuntu1","3.0.0~rc1-1ubuntu3","3.0.0~rc2-1ubuntu1","3.0.0~rc2-2ubuntu1","3.0.0~rc2-2ubuntu2","3.0.0~rc4-1ubuntu1","3.0.0~rc7-2ubuntu1","3.0.0~rc8-1ubuntu1","3.0.0-1ubuntu1","3.0.1-1ubuntu5","3.0.1-2ubuntu1","3.0.1-2ubuntu2","3.0.1-3","3.0.1-3build1","3.0.2-0ubuntu0.1","3.0.3-1-1ubuntu1","3.0.4-1ubuntu0.2","3.0.7.1-0ubuntu18.04.1","3.0.8-0ubuntu18.04.1","3.0.8-0ubuntu18.04.1+esm1","3.0.8-0ubuntu18.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libmicrodns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.8-1ubuntu0.1~esm1"}]}],"versions":["0.0.7-2","0.0.8-1"],"bundled":7}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"videolabs","product":"libmicrodns"}],"references":[{"url":"https://www.debian.org/security/2020/dsa-4671","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202005-10","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2020-1002","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","evidence","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6079"},{"url":"https://github.com/advisories/GHSA-484g-rjcp-74rc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-6079","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-6079","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0203.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26467","tags":["report"]},{"url":"https://www.videolan.org/security/sb-vlc309.html","tags":["web"]},{"url":"https://www.videolan.org/developers/vlc-branch/NEWS","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-6079","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-6079","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7239-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-6071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6080","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-6079","description":"An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger this vulnerability through decoding of the domain name performed by rr_decode.","status":"published","published":"2020-03-24T20:49:46Z","modified":"2026-10-08T21:13:50.796Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:52.268457Z"}],"euvd":[{"id":"EUVD-2020-27233","description":"An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger this vulnerability through decoding of the domain name performed by rr_decode.","status":"published","published":"2020-03-24T20:49:46Z","modified":"2026-10-08T21:13:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:26.452288Z"}],"ghsa":[{"id":"GHSA-484g-rjcp-74rc","title":"An exploitable denial-of-service vulnerability exists in the resource allocation handling of...","description":"An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger this vulnerability through decoding of the domain name performed by rr_decode.","status":"published","published":"2022-05-24T17:12:34Z","modified":"2023-01-29T05:02:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-401"],"updated_at":"2026-11-02T14:44:58.707257Z"}],"nvd":[{"id":"CVE-2020-6079","description":"An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger this vulnerability through decoding of the domain name performed by rr_decode.","status":"published","published":"2020-03-24T21:15:14.427Z","modified":"2026-10-08T22:17:02.147Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:05:56.580228Z"}],"osv":[{"id":"ALPINE-CVE-2020-6079","description":"An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger this vulnerability through decoding of the domain name performed by rr_decode.","status":"published","published":"2020-03-24T21:15:14.427Z","modified":"2026-11-03T06:32:31.300495402Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"CVE-2020-6079","description":"An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger this vulnerability through decoding of the domain name performed by rr_decode.","status":"published","published":"2020-03-24T21:15:14.427Z","modified":"2026-10-24T10:30:50.117502568Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.936975Z"},{"id":"DEBIAN-CVE-2020-6079","description":"An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger this vulnerability through decoding of the domain name performed by rr_decode.","status":"published","published":"2020-03-24T21:15:14.427Z","modified":"2026-10-26T12:02:07.234787586Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"UBUNTU-CVE-2020-6079","description":"An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger this vulnerability through decoding of the domain name performed by rr_decode.","status":"published","published":"2020-03-24T21:15:00Z","modified":"2026-04-22T12:42:43.59203Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:25.179924Z"},{"id":"DSA-4671-1","title":"vlc - security update","status":"published","published":"2020-04-30T00:00:00Z","modified":"2026-03-09T02:11:34.378586Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0203","title":"Updated vlc packages fix security vulnerabilities","description":"Multiple security issues were discovered in the microdns plugin of the\nVLC media player, which could result in denial of service or potentially\nthe execution of arbitrary code via malicious mDNS packets (CVE-2020-6071,\nCVE-2020-6072, CVE-2020-6073, CVE-2020-6077, CVE-2020-6078, CVE-2020-6079,\nCVE-2020-6080).\n\nVLC has been updated to 3.0.10 to fix theese and other issues.\n","status":"published","published":"2020-05-08T10:57:54Z","modified":"2026-04-16T04:43:03.53543783Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"USN-7239-1","title":"libmicrodns vulnerabilities","description":"It was discovered that libmicrodns could recursively follow the same\ncompression pointer, leading to an infinite loop. An attacker could\npossibly use this issue to cause a denial of service. (CVE-2020-6071)\n\nIt was discovered that libmicrodns did not check the return value of the\nrr_decode function, which could lead to a double free. An attacker could\npossibly use this issue to execute arbitrary code. (CVE-2020-6072)\n\nIt was discovered that libmicrodns incorrectly handled certain inputs,\nwhich could lead to an integer overflow. An attacker could possibly use\nthis issue to cause a denial of service. (CVE-2020-6073)\n\nIt was discovered that libmicrodns incorrectly handled certain inputs,\nwhich could lead to a out-of-bounds read. An attacker could possibly use\nthis issue to cause a denial of service. (CVE-2020-6077)\n\nIt was discovered that libmicrodns incorrectly handled memory when parsing\nmDNS messages in mdns_recv, which could lead to a NULL pointer dereference.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2020-6078)\n\nIt was discovered that libmicrodns incorrectly handled memory, which could\nlead to excessive memory consumption due to memory leaks. An attacker\ncould possibly use this issue to cause a denial of service.\n(CVE-2020-6079, CVE-2020-6080)\n","status":"published","published":"2025-01-28T23:36:20Z","modified":"2026-04-22T10:54:16.199918Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}