In VideoLAN VLC media player 3.0.7.1, there is a NULL pointer dereference at the function SeekPercent of demux/asf/asf.c that will lead to a denial of service attack.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Vlc_media_player | Videolan | 3.0.7.1 (including) | 3.0.7.1 (including) |
| Vlc | Ubuntu | bionic | * |
| Vlc | Ubuntu | disco | * |
| Vlc | Ubuntu | esm-apps/bionic | * |
| Vlc | Ubuntu | esm-apps/xenial | * |
| Vlc | Ubuntu | trusty | * |
| Vlc | Ubuntu | upstream | * |
| Vlc | Ubuntu | xenial | * |
Potential Mitigations
References
- http://git.videolan.org/?p=vlc.git\u0026a=search\u0026h=refs/heads/master\u0026st=commit\u0026s=cve-2019
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html
- https://seclists.org/bugtraq/2019/Aug/36
- https://security.gentoo.org/glsa/201909-02
- https://usn.ubuntu.com/4131-1/
- https://www.debian.org/security/2019/dsa-4504
- https://www.videolan.org/security/sb-vlc308.html
- http://git.videolan.org/?p=vlc.git\u0026a=search\u0026h=refs/heads/master\u0026st=commit\u0026s=cve-2019
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html
- https://seclists.org/bugtraq/2019/Aug/36
- https://security.gentoo.org/glsa/201909-02
- https://usn.ubuntu.com/4131-1/
- https://www.debian.org/security/2019/dsa-4504
- https://www.videolan.org/security/sb-vlc308.html