Security Advisory 1901
Summary : Read buffer overflow & double free Date
: June 2019 Affected versions : VLC media player 3.0.6 and earlier ID : VideoLAN-SA-1901 CVE reference : CVE-2019-5439, CVE-2019-12874
A remote user can create some specially crafted avi or mkv files that, when loaded by the target user, will trigger a heap buffer overflow (read) in ReadFrame (demux/avi/avi.c), or a double free in zlib_decompress_extra() (demux/mkv/utils.cpp) respectively Impact
If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user. Threat mitigation
Exploitation of those issues requires the user to explicitly open a specially crafted file or stream.
ASLR and DEP help reduce exposure, but may be bypassed. Workarounds
The user should refrain from opening files from untrusted third parties or accessing untrusted remote sites (or disable the VLC browser plugins), until the patch is applied. Solution
VLC media player 3.0.7 addresses the issue.
According to them, installing VLC media player 3.0.7 will fix the issue.
However, the one available in Ubuntu is the old version 3.0.4
user@linux:~$ apt show vlc Package: vlc Version: 3.0.4-1ubuntu0.2 Priority: optional Section: universe/graphics Origin: Ubuntu
Isn't this considered as high security risk?