Vulnerability Name:

CVE-2019-13962 (CCN-165455)

Assigned:2019-04-29
Published:2019-04-29
Updated:2022-04-18
Summary:lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
CVSS v3 Severity:9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
3.3 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
2.9 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
1.7 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-125
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2019-13962

Source: MISC
Type: Mailing List, Patch, Vendor Advisory
http://git.videolan.org/?p=vlc/vlc-3.0.git;a=commit;h=2b4f9d0b0e0861f262c90e9b9b94e7d53b864509

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2019:1840

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2019:1897

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2019:1909

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2019:2015

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2020:0545

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2020:0562

Source: BID
Type: Broken Link
109306

Source: XF
Type: UNKNOWN
videolan-cve201913962-dos(165455)

Source: BUGTRAQ
Type: Mailing List, Third Party Advisory
20190821 [SECURITY] [DSA 4504-1] vlc security update

Source: GENTOO
Type: Third Party Advisory
GLSA-201909-02

Source: CCN
Type: VideoLAN Web site
avcodec picture copy heap-buffer-overflow

Source: MISC
Type: Exploit, Vendor Advisory
https://trac.videolan.org/vlc/ticket/22240

Source: UBUNTU
Type: Third Party Advisory
USN-4131-1

Source: DEBIAN
Type: Third Party Advisory
DSA-4504

Vulnerable Configuration:Configuration 1:
  • cpe:/a:videolan:vlc_media_player:*:*:*:*:*:*:*:* (Version <= 3.0.7)

    • Configuration 2:
  • cpe:/a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*
  • OR cpe:/a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*
  • OR cpe:/o:opensuse:leap:15.0:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:leap:15.1:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:videolan:vlc_media_player:3.0.7:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:201913962
    V
    		CVE-2019-13962
    2022-06-30
    oval:org.opensuse.security:def:112905
    P
    		libvlc5-3.0.16-1.5 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:64635
    P
    		Security update for python-pip (Moderate)
    2021-12-13
    oval:org.opensuse.security:def:106364
    P
    		libvlc5-3.0.16-1.5 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:63194
    P
    		apache2-mod_jk-1.2.43-3.3.1 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:64577
    P
    		Security update for xen (Moderate)
    2021-09-18
    oval:org.opensuse.security:def:74309
    P
    		Security update for wireshark (Moderate)
    2021-09-13
    oval:org.opensuse.security:def:64747
    P
    		Security update for krb5 (Important)
    2021-08-20
    oval:org.opensuse.security:def:63323
    P
    		dhcp-relay-4.3.5-6.6.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63056
    P
    		hdf5-gnu-hpc-1.10.7-2.25 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63420
    P
    		djvulibre-3.5.27-9.28 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:62827
    P
    		python3-cupshelpers-1.5.7-6.27 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:63030
    P
    		pam-devel-32bit-1.3.0-6.29.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62820
    P
    		newt-devel-0.52.20-5.35 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62824
    P
    		ppp-2.4.7-5.3.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:100309
    P
    		 (Important)
    2021-07-15
    oval:org.opensuse.security:def:63526
    P
    		NetworkManager-lang-1.10.6-3.16 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:62854
    P
    		glibc-devel-32bit-2.26-11.8 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:62852
    P
    		dpkg-1.19.0.4-2.30 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:93443
    P
    		 (Important)
    2021-03-24
    oval:org.opensuse.security:def:93596
    P
    		 (Important)
    2021-02-17
    oval:org.opensuse.security:def:74689
    P
    		Security update for subversion (Important)
    2021-02-10
    oval:org.opensuse.security:def:64475
    P
    		Security update for open-iscsi (Important)
    2021-01-14
    oval:org.opensuse.security:def:62375
    P
    		containerd-1.2.10-5.19.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62575
    P
    		libplist++-devel-2.0.0-1.31 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62374
    P
    		buildah-1.7.1-3.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62398
    P
    		colord-color-profiles-1.4.2-1.37 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63747
    P
    		Security update for curl (Important)
    2020-12-01
    oval:org.opensuse.security:def:64243
    P
    		e2fsprogs on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64368
    P
    		libpng12-0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:63673
    P
    		Security update for ovmf (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64231
    P
    		cracklib on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:63987
    P
    		Security update for wicked (Important)
    2020-12-01
    oval:org.opensuse.security:def:74822
    P
    		Security update for vlc (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64131
    P
    		Security update for python-ipaddress (Important)
    2020-12-01
    oval:org.opensuse.security:def:63881
    P
    		Security update for wireshark (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:74183
    P
    		Security update for samba (Important)
    2020-12-01
    oval:org.opensuse.security:def:63902
    P
    		Security update for wget (Important)
    2020-12-01
    oval:org.opensuse.security:def:64367
    P
    		libpcsclite1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64089
    P
    		Security update for spice-gtk (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:110484
    P
    		Security update for vlc (Moderate)
    2020-04-23
    oval:org.opensuse.security:def:100156
    P
    		 (Moderate)
    2019-10-03
    oval:org.opensuse.security:def:109933
    P
    		Security update for vlc (Important)
    2019-08-08
    oval:com.ubuntu.bionic:def:2019139620000000
    V
    		CVE-2019-13962 on Ubuntu 18.04 LTS (bionic) - low.
    2019-07-18
    oval:com.ubuntu.xenial:def:2019139620000000
    V
    		CVE-2019-13962 on Ubuntu 16.04 LTS (xenial) - low.
    2019-07-18
    oval:com.ubuntu.disco:def:2019139620000000
    V
    		CVE-2019-13962 on Ubuntu 19.04 (disco) - low.
    2019-07-18
    BACK
    videolan vlc media player *
    opensuse backports sle 15.0 -
    opensuse backports sle 15.0 sp1
    opensuse leap 15.0
    opensuse leap 15.1
    debian debian linux 9.0
    debian debian linux 10.0
    canonical ubuntu linux 18.04
    canonical ubuntu linux 19.04
    videolan vlc media player 3.0.7