Vulnerability Name:

CVE-2019-5459 (CCN-164548)

Assigned:2019-07-23
Published:2019-07-23
Updated:2021-11-03
Summary:An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read.
CVSS v3 Severity:7.1 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
6.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): High
3.3 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
2.9 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:5.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): Partial
1.7 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-191
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2019-5459

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2019:1840

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2019:1897

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2019:1909

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2019:2015

Source: XF
Type: UNKNOWN
videolan-cve20195459-dos(164548)

Source: CCN
Type: Hackerone Web site
Access Violation Reading in libfaad_plugin

Source: MISC
Type: Exploit, Third Party Advisory
https://hackerone.com/reports/502816

Source: CCN
Type: VideoLAN Web site
VLC media player

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2019-5459

Vulnerable Configuration:Configuration 1:
  • cpe:/a:videolan:vlc_media_player:*:*:*:*:*:*:*:* (Version < 3.0.7)

    • Configuration 2:
  • cpe:/a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*
  • OR cpe:/o:opensuse:backports:sle-15:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:leap:15.0:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:leap:15.1:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:videolan:vlc_media_player:3.0.6:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20195459
    V
    		CVE-2019-5459
    2022-06-30
    oval:org.opensuse.security:def:63194
    P
    		apache2-mod_jk-1.2.43-3.3.1 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:74309
    P
    		Security update for wireshark (Moderate)
    2021-09-13
    oval:org.opensuse.security:def:63420
    P
    		djvulibre-3.5.27-9.28 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63056
    P
    		hdf5-gnu-hpc-1.10.7-2.25 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:62854
    P
    		glibc-devel-32bit-2.26-11.8 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:93443
    P
    		 (Important)
    2021-03-24
    oval:org.opensuse.security:def:62575
    P
    		libplist++-devel-2.0.0-1.31 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62374
    P
    		buildah-1.7.1-3.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62375
    P
    		containerd-1.2.10-5.19.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62398
    P
    		colord-color-profiles-1.4.2-1.37 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63987
    P
    		Security update for wicked (Important)
    2020-12-01
    oval:org.opensuse.security:def:74183
    P
    		Security update for samba (Important)
    2020-12-01
    oval:org.opensuse.security:def:64089
    P
    		Security update for spice-gtk (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:63747
    P
    		Security update for curl (Important)
    2020-12-01
    oval:org.opensuse.security:def:64131
    P
    		Security update for python-ipaddress (Important)
    2020-12-01
    oval:org.opensuse.security:def:63881
    P
    		Security update for wireshark (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64243
    P
    		e2fsprogs on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:100156
    P
    		 (Moderate)
    2019-10-03
    oval:org.opensuse.security:def:109933
    P
    		Security update for vlc (Important)
    2019-08-08
    oval:com.ubuntu.bionic:def:201954590000000
    V
    		CVE-2019-5459 on Ubuntu 18.04 LTS (bionic) - medium.
    2019-07-30
    oval:com.ubuntu.xenial:def:201954590000000
    V
    		CVE-2019-5459 on Ubuntu 16.04 LTS (xenial) - medium.
    2019-07-30
    oval:com.ubuntu.disco:def:201954590000000
    V
    		CVE-2019-5459 on Ubuntu 19.04 (disco) - medium.
    2019-07-30
    BACK
    videolan vlc media player *
    opensuse backports sle 15.0 sp1
    opensuse backports sle-15
    opensuse leap 15.0
    opensuse leap 15.1
    videolan vlc media player 3.0.6