CVE-2019-13615
Fixed in a distro release EPSS 2%
libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.
Products: videolan vlc_media_player
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | libebml | 1.3.6-r0 |
| Alpine 3.11 | libebml | 1.3.6-r0 |
| Alpine 3.7 | libebml | 1.3.5-r1 |
| Alpine 3.8 | libebml | 1.3.6-r0 |
| Alpine 3.9 | libebml | 1.3.6-r0 |
| Debian 12 | libebml | 1.3.6-1 |
| Debian 13 | libebml | 1.3.6-1 |
| Debian 14 | libebml | 1.3.6-1 |
| Ubuntu 16.04 LTS | libebml | 1.3.3-1ubuntu0.1 |
| Ubuntu 18.04 LTS | libebml | 1.3.5-2ubuntu0.1 |