CVE-2020-13428
Fixed in a distro release EPSS 2%
A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.
Products: videolan vlc_media_player, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | vlc | 3.0.11-0+deb10u1 |
| Debian 12 | vlc | 3.0.11-1 |
| Debian 13 | vlc | 3.0.11-1 |
| Debian 14 | vlc | 3.0.11-1 |
| Debian 9 | vlc | 3.0.11-0+deb9u1 |
| SUSE Package Hub 15 SP1 | vlc | 3.0.11.1-bp151.5.12.1 |
| SUSE Package Hub 15 SP2 | vlc | 3.0.11.1-bp152.2.9.1 |
| Ubuntu Pro 16.04 LTS | vlc | 2.2.2-5ubuntu0.16.04.5+esm2 |
| Ubuntu Pro 18.04 LTS | vlc | 3.0.8-0ubuntu18.04.1+esm1 |
| Ubuntu Pro 20.04 LTS | vlc | 3.0.9.2-1ubuntu0.1~esm1 |
| Ubuntu Pro 22.04 LTS | vlc | 3.0.16-1ubuntu0.1~esm1 |
| openSUSE Leap 15.1 | vlc | 3.0.11.1-lp151.6.12.1 |
| openSUSE Leap 15.2 | vlc | 3.0.11.1-lp152.2.9.1 |
| openSUSE Tumbleweed | vlc | 3.0.16-1.5 |