Subject: [ASA-201906-22] vlc: arbitrary code execution

Arch Linux Security Advisory ASA-201906-22
==========================================

Severity: Critical
Date    : 2019-06-25
CVE-ID  : CVE-2019-5439 CVE-2019-12874
Package : vlc
Type    : arbitrary code execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-998

Summary
=======

The package vlc before version 3.0.7.1-1 is vulnerable to arbitrary
code execution.

Resolution
==========

Upgrade to 3.0.7.1-1.

# pacman -Syu "vlc>=3.0.7.1-1"

The problems have been fixed upstream in version 3.0.7.1.

Workaround
==========

None.

Description
===========

- CVE-2019-5439 (arbitrary code execution)

VideoLAN VLC media player 3.0.6 and earlier has a out-of-bounds write
has been found in the ReadFrame function of the AVI decoder.

- CVE-2019-12874 (arbitrary code execution)

VideoLAN VLC media player 3.0.6 and earlier has a double-free in the
zlib_decompress_extra function of the Matroska demuxer in
modules/demux/mkv/util.cpp.

Impact
======

A remote attacker is able to execute arbitrary code on the host by
providing a maliciously-crafted media file to VLC.

References
==========

https://www.videolan.org/security/sa1901.html
https://hackerone.com/reports/484398
https://git.videolan.org/?p=vlc.git;a=commit;h=81023659c7de5ac2637b4a879195efef50846102
https://security.archlinux.org/CVE-2019-5439
https://security.archlinux.org/CVE-2019-12874