Vulnerability CVE-2020-13428: Information

Description

A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.

Severity: HIGH (7.8) Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2020-13428
Published: June 8, 2020
Modified: Nov. 7, 2023
Error type identifier: CWE-787

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
vlcsisyphus3.0.11-alt13.0.20-alt1ALT-PU-2020-2237-1254085Fixed
vlcp103.0.11-alt13.0.18-alt3ALT-PU-2020-2237-1254085Fixed
vlcp93.0.11-alt13.0.16-alt1ALT-PU-2020-2248-1254089Fixed
vlcc10f13.0.11-alt13.0.20-alt1ALT-PU-2020-2237-1254085Fixed
vlcc9f23.0.11-alt13.0.11-alt1ALT-PU-2020-2248-1254089Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://github.com/videolan/vlc-3.0/releases/tag/3.0.11
  • Release Notes
  • Third Party Advisory
https://github.com/videolan/vlc/commits/master/modules/packetizer/hxxx_nal.c
  • Patch
  • Third Party Advisory
DSA-4704
  • Third Party Advisory
https://www.videolan.org/security/sb-vlc3011.html
  • Vendor Advisory
http://git.videolan.org/?p=vlc/vlc-3.0.git%3Ba=commit%3Bh=d5c43c21c747ff30ed19fcca745dea3481c733e0

      1. Configuration 1

        cpe:2.3:a:videolan:vlc_media_player:*:*:*:*:*:iphone_os:*:*
        End excliding
        3.0.11
        cpe:2.3:a:videolan:vlc_media_player:*:*:*:*:*:macos:*:*
        End excliding
        3.0.11

        Configuration 2

        cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
        cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
    VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
    Version: v24.5.1
    Back to top