#VU16333 Improper input validation in VLC Media Player - CVE-2018-19857
Published: December 7, 2018 / Updated: December 7, 2018
Vulnerability identifier: #VU16333
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2018-19857
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
VLC Media Player
VLC Media Player
Software vendor:
VideoLAN
VideoLAN
Description
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to improper handling of magic cookies in Core Audio Format (CAF) files, which could result in an uninitialized memory read in the CAF demuxer. A remote attacker can trick the victim into accessing a CAF file that submits malicious input, trigger typecast that converts a possibly negative return value to an unsigned integer in the ReadKukiChunk() function and cause the service to crash.
Remediation
Install update from vendor's website.