FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

vlc -- Buffer overflow vulnerability

Affected packages
		vlc	<	3.0.7,4

Details

VuXML ID	f2144530-936f-11e9-8fc4-5404a68ad561
Discovery	2019-01-23
Entry	2019-06-20

zhangyang reports:

The ReadFrame function in the avi.c file uses a variable i_width_bytes, which is obtained directly from the file. It is a signed integer. It does not do a strict check before the memory operation(memmove, memcpy), which may cause a buffer overflow.

[source]

References

CVE Name	CVE-2019-5439
URL	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5439
URL	https://hackerone.com/reports/484398