Warning over critical security flaw in VLC Media Player

clock • 2 min read

Exploits expected to emerge within days to take advantage of 9.8-rated critical security flaw in VLC Media Player

Computing has published an update to this story after VideoLAN, the organisation behind VLC Media Player, claimed that the security flaw had been fixed 16 months ago, and that CERT-Bund and MITRE had acted before testing the vulnerability first. 

Another critical vulnerability in VLC Media Player, which could enable hackers to access and modify data on devices, has been identified by German cyber-security agency CERT-Bund.

CERT-Bund has not yet observed the vulnerability being exploited in the wild by attackers. However, exploits will almost certainly emerge in the coming days considering that the vulnerability is now in public domain. In addition, a fix has yet to be released. 

The newly discovered flaw, indexed as CVE-2019-13615, exists in VLC Media Player version 3.0.7.1 - the newest release of the application, according to CERT-Bund. It is rated at 9.8 in NIST's National Vulnerability Database, making it a 'critical' vulnerability. The flaw enables remote code execution (RCE), unauthorised modification and disclosure of data/files and disruption of service.

"VideoLAN VLC media player 3.0.7.1 has a heap-based buffer over-read in mkv::demux_sys_t::FreeUnused() in modules/demux/mkv/demux.cpp when called from mkv::Open in modules/demux/mkv/mkv.cpp," the CVE report notes.

According to WinFuture, the issue exists in Windows, Linux and UNIX versions of the programme, while the macOS version appears seemingly unaffected.

VLC Media Player's developer, the non-profit organisation VideoLAN, is currently working on a patch that, it claims, is now 60 per cent complete. The company has been working on the fix for the past four weeks, according to the bug report by the company.

Last month, VideoLAN released the biggest single security update for VLC Media Player in the history of the programme. The update included fixes for 33 vulnerabilities in total, of which two were marked critical, 21 medium and 10 rated low.

The first critical flaw, indexed as CVE-2019-12874, is an out-of-bounds write flaw in the decoder library of FAAD2 MPEG-4 and MPEG-2 AAC used by VLC 3.0.6 and earlier.

The second critical flaw, indexed as CVE-2019-5439, is a stack buffer overflow flaw. It exists in version 4.0.0 beta's Reliable Internet Stream Transport and could allow for RCE at the user's privilege level.

VLC is a popular and widely used open-source media player app, boasting more than three billion downloads worldwide. The application can play almost every multimedia format going and is free to download and use.

July has been a particular busy time for patches and updates, with Oracle releasing a tranche of more than 300 last week, while Microsoft's July Patch Tuesday addressed 77 vulnerabilities

BlackBerry, meanwhile, is this week rushing out a patch to fix flaws in its Cylance anti-virus software

You may also like
Atlassian releases security updates to address high-severity bugs

Threats and Risks

Company advises users to upgrade their instances to the latest available version

clock 25 September 2023 • 2 min read
Fortinet resolves critical vulnerability affecting FortiNAC solution

Threats and Risks

The bug could allow an unauthenticated user to execute unauthorised commands via specifically crafted requests

clock 27 June 2023 • 3 min read
Cisco fixes critical bugs affecting Small Business Series Switches

Threats and Risks

Proof-of-concept exploit codes are available

clock 18 May 2023 • 3 min read
Upcoming events

Sign up to our newsletter

The best news, stories, features and photos from the day in one perfectly formed email.

More on Threats and Risks

Microsoft warns of new ransomware campaign by the Twisted Spider group

Microsoft warns of new ransomware campaign by Twisted Spider group

Uses malvertising to spread Danbot Trojan, then Cactus ransomware

John Leonard
clock 01 December 2023 • 2 min read
Google rushes out patch for Chrome zero-day with exploit available in the wild

Google rushes out patch for Chrome zero-day with exploit available in the wild

Other Chromium-based browsers are also vulnerable to the flaw in the Skia graphics library

clock 30 November 2023 • 3 min read
18,000 customers at risk of phishing attacks after security firm Otka hacked

Customers at risk of phishing attacks after hack, Okta warns

Software security firm Otka has warned that some of its 18,000 corporate and government customers have been left vulnerable to phishing attacks after hackers broke into its computer systems a month ago.

clock 30 November 2023 • 1 min read