Vulnerability Name:

CVE-2019-13602 (CCN-163764)

Assigned:2019-06-28
Published:2019-06-28
Updated:2022-04-18
Summary:An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.
CVSS v3 Severity:7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
3.3 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
2.9 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
1.7 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-787
CWE-191
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2019-13602

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2019:1840

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2019:1897

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2019:1909

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2019:2015

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2020:0545

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2020:0562

Source: BID
Type: Broken Link
109158

Source: XF
Type: UNKNOWN
videolan-cve201913602-dos(163764)

Source: CCN
Type: vlc GIT Repository
mp4: fix integer underflow

Source: MISC
Type: Mailing List, Vendor Advisory
https://git.videolan.org/?p=vlc.git;a=commit;h=8e8e0d72447f8378244f5b4a3dcde036dbeb1491

Source: MISC
Type: Mailing List, Vendor Advisory
https://git.videolan.org/?p=vlc.git;a=commit;h=b2b157076d9e94df34502dd8df0787deb940e938

Source: BUGTRAQ
Type: Mailing List, Third Party Advisory
20190821 [SECURITY] [DSA 4504-1] vlc security update

Source: GENTOO
Type: Third Party Advisory
GLSA-201909-02

Source: UBUNTU
Type: Third Party Advisory
USN-4074-1

Source: DEBIAN
Type: Third Party Advisory
DSA-4504

Vulnerable Configuration:Configuration 1:
  • cpe:/a:videolan:vlc_media_player:*:*:*:*:*:*:*:* (Version <= 3.0.7.1)

    • Configuration 2:
  • cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*
  • OR cpe:/a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*
  • OR cpe:/o:opensuse:leap:15.0:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:leap:15.1:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:videolan:vlc_media_player:3.0.7.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:201913602
    V
    		CVE-2019-13602
    2022-06-30
    oval:org.opensuse.security:def:112905
    P
    		libvlc5-3.0.16-1.5 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:64635
    P
    		Security update for python-pip (Moderate)
    2021-12-13
    oval:org.opensuse.security:def:106364
    P
    		libvlc5-3.0.16-1.5 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:63194
    P
    		apache2-mod_jk-1.2.43-3.3.1 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:64577
    P
    		Security update for xen (Moderate)
    2021-09-18
    oval:org.opensuse.security:def:74309
    P
    		Security update for wireshark (Moderate)
    2021-09-13
    oval:org.opensuse.security:def:64747
    P
    		Security update for krb5 (Important)
    2021-08-20
    oval:org.opensuse.security:def:63323
    P
    		dhcp-relay-4.3.5-6.6.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63056
    P
    		hdf5-gnu-hpc-1.10.7-2.25 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63420
    P
    		djvulibre-3.5.27-9.28 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:62827
    P
    		python3-cupshelpers-1.5.7-6.27 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:63030
    P
    		pam-devel-32bit-1.3.0-6.29.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62820
    P
    		newt-devel-0.52.20-5.35 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62824
    P
    		ppp-2.4.7-5.3.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:100309
    P
    		 (Important)
    2021-07-15
    oval:org.opensuse.security:def:63526
    P
    		NetworkManager-lang-1.10.6-3.16 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:62854
    P
    		glibc-devel-32bit-2.26-11.8 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:62852
    P
    		dpkg-1.19.0.4-2.30 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:93443
    P
    		 (Important)
    2021-03-24
    oval:org.opensuse.security:def:93596
    P
    		 (Important)
    2021-02-17
    oval:org.opensuse.security:def:74689
    P
    		Security update for subversion (Important)
    2021-02-10
    oval:org.opensuse.security:def:64475
    P
    		Security update for open-iscsi (Important)
    2021-01-14
    oval:org.opensuse.security:def:62375
    P
    		containerd-1.2.10-5.19.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62575
    P
    		libplist++-devel-2.0.0-1.31 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62374
    P
    		buildah-1.7.1-3.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62398
    P
    		colord-color-profiles-1.4.2-1.37 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63747
    P
    		Security update for curl (Important)
    2020-12-01
    oval:org.opensuse.security:def:64243
    P
    		e2fsprogs on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64368
    P
    		libpng12-0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:63673
    P
    		Security update for ovmf (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64231
    P
    		cracklib on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:63987
    P
    		Security update for wicked (Important)
    2020-12-01
    oval:org.opensuse.security:def:74822
    P
    		Security update for vlc (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64131
    P
    		Security update for python-ipaddress (Important)
    2020-12-01
    oval:org.opensuse.security:def:63881
    P
    		Security update for wireshark (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:74183
    P
    		Security update for samba (Important)
    2020-12-01
    oval:org.opensuse.security:def:63902
    P
    		Security update for wget (Important)
    2020-12-01
    oval:org.opensuse.security:def:64367
    P
    		libpcsclite1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64089
    P
    		Security update for spice-gtk (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:110484
    P
    		Security update for vlc (Moderate)
    2020-04-23
    oval:org.opensuse.security:def:100156
    P
    		 (Moderate)
    2019-10-03
    oval:org.opensuse.security:def:109933
    P
    		Security update for vlc (Important)
    2019-08-08
    oval:com.ubuntu.bionic:def:2019136020000000
    V
    		CVE-2019-13602 on Ubuntu 18.04 LTS (bionic) - medium.
    2019-07-14
    oval:com.ubuntu.xenial:def:2019136020000000
    V
    		CVE-2019-13602 on Ubuntu 16.04 LTS (xenial) - medium.
    2019-07-14
    oval:com.ubuntu.disco:def:2019136020000000
    V
    		CVE-2019-13602 on Ubuntu 19.04 (disco) - medium.
    2019-07-14
    BACK
    videolan vlc media player *
    debian debian linux 9.0
    debian debian linux 10.0
    canonical ubuntu linux 18.04
    canonical ubuntu linux 19.04
    opensuse backports sle 15.0 -
    opensuse backports sle 15.0 sp1
    opensuse leap 15.0
    opensuse leap 15.1
    videolan vlc media player 3.0.7.1