内容简介:A remote user could create a specifically crafted file that could trigger a buffer overflow in VLC's H26X packetizerIf successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target
Summary : Multiple vulnerabilities fixed in VLC media player Date : June 2020 Affected versions : VLC media player 3.0.10 and earlier ID : VideoLAN-SB-VLC-3011 CVE references : CVE-2020-13428
Details
A remote user could create a specifically crafted file that could trigger a buffer overflow in VLC's H26X packetizer
Impact
If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user.
While these issues in themselves are most likely to just crash the player, we can't exclude that they could be combined to leak user informations or remotely execute code. ASLR and DEP help reduce the likelyness of code execution, but may be bypassed.
We have not seen exploits performing code execution through these vulnerability
Threat mitigation
Exploitation of those issues requires the user to explicitly open a specially crafted file or stream.
Workarounds
The user should refrain from opening files from untrusted third parties or accessing untrusted remote sites (or disable the VLC browser plugins), until the patch is applied.
Solution
VLC media player 3.0.11 addresses the issue.
Credits
CVE-2020-13428 was reported by Tommy Muir
Additional notes
VLC 3.0.11 also bumps some dependencies, notably libarchive, following the publication of CVE-2020-9308 and CVE-2019-19221
References
- The VideoLAN project
- http://www.videolan.org/
- VLC official GIT repository
- http://git.videolan.org/?p=vlc.git
以上所述就是小编给大家介绍的《Security Bulletin VLC 3.0.11》,希望对大家有所帮助,如果大家有任何疑问请给我留言,小编会及时回复大家的。在此也非常感谢大家对 码农网 的支持!
猜你喜欢:本站部分资源来源于网络,本站转载出于传递更多信息之目的,版权归原作者或者来源机构所有,如转载稿涉及版权问题,请联系我们。
Series 60 应用程序开发
巴克 / 人民邮电出版社 / 2005-7 / 75.0
Series 60智能手机开发平台正掀起新一轮的移动服务浪潮。超过60%的手机生产商获得了Series 60平台的授权。Series 60移动应用开发平台拥有最大的用户群,从而成为智能手机市场的代表。诺基亚与EMCC软件公司合作,为C++程序员和软件设计师编撰了这本Series 60开发的权威指南。本书由诺基亚资深专家进行了全面审阅。本书内容涉及了开发过程的各个阶段,从设计、编程、测试、调试到部署......一起来看看 《Series 60 应用程序开发》 这本书的介绍吧!