• Welcome to TechPowerUp Forums, Guest! Please check out our forum guidelines for info related to our community.

Stay away from VLC Player, critical flaw allows hackers in

Status
Not open for further replies.
Joined
Oct 17, 2014
Messages
3,859 (2.08/day)
Location
USA
System Name Paladius Tacet ($789 total)
Processor Ryzen 3600 @ 4.10 all core 1.30v ($162)
Motherboard MSI B450 Gaming Plus MAX ($99)
Cooling Noctua NH-D14 (re-use)
Memory G.Skill 2x8GB (16GB) 3800 CAS 16-17-16-32 FCLK @ 1900 @ 1.45v ($108)
Video Card(s) EVGA GTX 1080 Ti SC ($410)
Storage 860 Evo 2TB SSD (re-use)
Display(s) X-Star 27" 2560x1440 @ 110hz (re-use)
Case Corsair 110Q Silent (graduation gift)
Power Supply EVGA 700w GD 80+ GOLD (graduation gift)

Saw this on Gizmodo and PCGamer and just thought I would share here, I have uninstalled it from my phone and PC.
 
Joined
Mar 28, 2018
Messages
460 (0.77/day)
Location
Arizona
System Name Space Heater MKIII
Processor AMD Ryzen 5 2600X
Motherboard MSI X470 Gaming Pro
Cooling Cryorig R1 Ultimate, 5x Cryorig XF140 fans
Memory 2x8GB Crucial Ballistix Sport DDR4-3000
Video Card(s) Gigabyte GTX 1070 G1 Gaming
Storage 500GB Samsung 970 EVO, 2+4TB Seagate Barracudas
Display(s) AOC AG241QX, 2x Dell 1908FP
Case Phanteks Enthoo Pro M
Audio Device(s) Klipsch ProMedia 2.1
Power Supply EVGA 750 B3, CyberPower CST135XLU
Mouse Logitech MX Master
Keyboard Logitech G610 Orion Brown
Software Windows 10 Pro
Benchmark Scores Geekbench 4 on i7: 14581 multi, 4225 single @4.5GHz (https://browser.geekbench.com/v4/cpu/8441992)
Joined
Oct 24, 2004
Messages
1,081 (0.20/day)
System Name Seriously ?
Processor Core i7 4790K @ 4.4Ghz
Motherboard MSI Z97 Gaming 5
Cooling Alpenföhne Broken 120 + 2 huge coolermaster chassis fans
Memory 2x8GB DDR3 2133Mhz Crucial Ballistix
Video Card(s) Gigabyte Geforce RTX 2070
Storage 1x Kingston SA400 128GB / 1x Crucial CT1050MX300 1TB / 1x Sandisk SSD Plus 1TB
Display(s) 40" Samsung UE40ES5500
Case Cooler Master HAF932
Audio Device(s) onboard realtek audio
Power Supply Corsair AX1200
Mouse Microsoft intellimouse optical
Keyboard Logitech K270
Software Windows 10 Pro
Benchmark Scores https://valid.x86.fr/vmb641

Current Description
VideoLAN VLC media player 3.0.7.1 has a heap-based buffer over-read in mkv::demux_sys_t::FreeUnused() in modules/demux/mkv/demux.cpp when called from mkv::Open in modules/demux/mkv/mkv.cpp.
and


#22474 new defect
heap-buffer-overflow on demux_sys_t::FreeUnused

./vlc ../fuzz/heap-over-flow.mp4
and then

Sorry, but this bug is not reproducible and does not crash VLC at all.

Windows: Not reproducible in 3.0.6 win64, 3.0.7.1 win64 or nightly 4.0.0-20190723-0832 win64 either.
using the aformentioned tampered heap-over-flow.mp4, you can try it for yourself with the file provided below

 
Joined
Oct 17, 2014
Messages
3,859 (2.08/day)
Location
USA
System Name Paladius Tacet ($789 total)
Processor Ryzen 3600 @ 4.10 all core 1.30v ($162)
Motherboard MSI B450 Gaming Plus MAX ($99)
Cooling Noctua NH-D14 (re-use)
Memory G.Skill 2x8GB (16GB) 3800 CAS 16-17-16-32 FCLK @ 1900 @ 1.45v ($108)
Video Card(s) EVGA GTX 1080 Ti SC ($410)
Storage 860 Evo 2TB SSD (re-use)
Display(s) X-Star 27" 2560x1440 @ 110hz (re-use)
Case Corsair 110Q Silent (graduation gift)
Power Supply EVGA 700w GD 80+ GOLD (graduation gift)
thanks for clarifying, I didn't read it all the way.
 
Joined
Jul 25, 2006
Messages
6,075 (1.25/day)
Location
Nebraska, USA
System Name Brightworks Systems BWS-6 E-IV
Processor Intel Core i5-6600 @ 3.9GHz
Motherboard Gigabyte GA-Z170-HD3 Rev 1.0
Cooling Quality case, 2 x Fractal Design 140mm fans, stock CPU HSF
Memory 16GB (2 x 8GB) DDR4 3000 Corsair Vengeance
Video Card(s) EVGA GEForce GTX 1050Ti 4Gb GDDR5
Storage Samsung 850 Pro 256GB SSD, Samsung 860 Evo 500GB SSD
Display(s) Samsung S24E650BW LED x 2
Case Fractal Design Define R4
Power Supply EVGA Supernova 550W G2 Gold
Mouse Microsoft Wireless 5000
Keyboard Microsoft Wireless Comfort 5050
Software W10 Pro 64-bit
I didn't read it all the way.
:( Probably something that should be done before posting derogatory, sensationalized, and "the sky is falling" warnings that unjustly criticize the innocent.

I recommend the subject of this thread be edited before the false claim and recommendation is picked up by Bing Google and goes viral. VLC is a great, and safe program and there is no need for anyone to remove it, or stay away from it.
 
Joined
Jun 22, 2019
Messages
17 (0.11/day)
Processor Core i5 8400
Motherboard Asrock B360 pro4
Memory 2x8 ddr4 2666mhz
Video Card(s) Gigabyte 980ti G1 Stock
Storage 120gb OS ssd, 1tb samsung 860 evo, 500gb samsung 860 evo
Display(s) BenQ Xl2411 @ 1080p 144hz
Case Corsair 100r
Audio Device(s) On-board
Power Supply Corsair RMx 750w (2018)
Mouse some generic cyberpower one with dpi switch
Keyboard Steelseries apex gaetron red switches "steelswitch QX2"
Does it affect older releases too I'm on 3.0.6
 

rtwjunkie

PC Gaming Enthusiast
Supporter
Joined
Jul 25, 2008
Messages
12,514 (3.03/day)
Location
Louisiana -Laissez les bons temps rouler!
System Name Bayou Devil
Processor Core i7-4790k 4.4Ghz @ 1.18v
Motherboard ASUS Z97 Deluxe
Cooling All air: 2x140mm Fractal exhaust; 3x 140mm Cougar Intake; Enermax T40F CPU cooler
Memory 2x 8GB Mushkin Redline DDR-3 1866
Video Card(s) MSI GTX 1080Ti Gaming X
Storage 1x 500 MX500 SSD; 1x 2TB WD Black; 2x 4TB WD Black;1x 2TB WD Green (eSATA)
Display(s) HP 27q 27" IPS @ 2560 x 1440
Case Fractal Design Define R4 Black w/Titanium front -windowed
Audio Device(s) Soundblaster Z
Power Supply Seasonic X-850
Mouse Coolermaster Sentinel III
Keyboard Logitech G610 Orion mechanical (Cherry Brown switches)
Software Windows 10 Pro 64-bit (Start10 & Fences 3.0 installed)
Does it affect older releases too I'm on 3.0.6
It is a good idea to always update it whenever it notifies you. Fully half of their updates are closing discovered security holes, whether anyone has been successful or not.

Indeed, even just going to 3.07 has numerous security fixes.


The change log for the latest has a long list of updates:
 
Last edited:
Joined
Oct 17, 2014
Messages
3,859 (2.08/day)
Location
USA
System Name Paladius Tacet ($789 total)
Processor Ryzen 3600 @ 4.10 all core 1.30v ($162)
Motherboard MSI B450 Gaming Plus MAX ($99)
Cooling Noctua NH-D14 (re-use)
Memory G.Skill 2x8GB (16GB) 3800 CAS 16-17-16-32 FCLK @ 1900 @ 1.45v ($108)
Video Card(s) EVGA GTX 1080 Ti SC ($410)
Storage 860 Evo 2TB SSD (re-use)
Display(s) X-Star 27" 2560x1440 @ 110hz (re-use)
Case Corsair 110Q Silent (graduation gift)
Power Supply EVGA 700w GD 80+ GOLD (graduation gift)
:( Probably something that should be done before posting derogatory, sensationalized, and "the sky is falling" warnings that unjustly criticize the innocent.

I recommend the subject of this thread be edited before the false claim and recommendation is picked up by Bing Google and goes viral. VLC is a great, and safe program and there is no need for anyone to remove it, or stay away from it.
not really, because I do use MKV files.... so.... yeah actually I still needed to remove it. so later alligator, have a good day. thanks for being a jerk though, much appreciated!
 

rtwjunkie

PC Gaming Enthusiast
Supporter
Joined
Jul 25, 2008
Messages
12,514 (3.03/day)
Location
Louisiana -Laissez les bons temps rouler!
System Name Bayou Devil
Processor Core i7-4790k 4.4Ghz @ 1.18v
Motherboard ASUS Z97 Deluxe
Cooling All air: 2x140mm Fractal exhaust; 3x 140mm Cougar Intake; Enermax T40F CPU cooler
Memory 2x 8GB Mushkin Redline DDR-3 1866
Video Card(s) MSI GTX 1080Ti Gaming X
Storage 1x 500 MX500 SSD; 1x 2TB WD Black; 2x 4TB WD Black;1x 2TB WD Green (eSATA)
Display(s) HP 27q 27" IPS @ 2560 x 1440
Case Fractal Design Define R4 Black w/Titanium front -windowed
Audio Device(s) Soundblaster Z
Power Supply Seasonic X-850
Mouse Coolermaster Sentinel III
Keyboard Logitech G610 Orion mechanical (Cherry Brown switches)
Software Windows 10 Pro 64-bit (Start10 & Fences 3.0 installed)
not really, because I do use MKV files.... so.... yeah actually I still needed to remove it. so later alligator, have a good day. thanks for being a jerk though, much appreciated!
The key being “infected” MKV flies though. I’m sure you are scanning files prior to playing them?
 
Joined
Oct 17, 2014
Messages
3,859 (2.08/day)
Location
USA
System Name Paladius Tacet ($789 total)
Processor Ryzen 3600 @ 4.10 all core 1.30v ($162)
Motherboard MSI B450 Gaming Plus MAX ($99)
Cooling Noctua NH-D14 (re-use)
Memory G.Skill 2x8GB (16GB) 3800 CAS 16-17-16-32 FCLK @ 1900 @ 1.45v ($108)
Video Card(s) EVGA GTX 1080 Ti SC ($410)
Storage 860 Evo 2TB SSD (re-use)
Display(s) X-Star 27" 2560x1440 @ 110hz (re-use)
Case Corsair 110Q Silent (graduation gift)
Power Supply EVGA 700w GD 80+ GOLD (graduation gift)
The key being “infected” MKV flies though. I’m sure you are scanning files prior to playing them?
Most files just come from my camera from traveling Europe, so I didn't feel the need to scan them, but yeah I probably should. that is my bad. but is windows defender even good enough to detect an "infected file" or would i need something liek bitdefender or malwarebytes?
 
Joined
Jul 10, 2008
Messages
265 (0.06/day)
Location
Wasteland
System Name Cast Lead™
Processor Intel(R) Core(TM) i5-7600 CPU @ 3.50GHz
Motherboard Asus ROG STRIX H270F GAMING
Cooling Cooler Master Hyper 212 LED
Memory G.SKILL Ripjaws V Series 8GB (2 x 4GB) DDR4 2400
Video Card(s) MSI Radeon RX 480 GAMING X 8G
Storage Seagate 1TB 7200 rpm
Display(s) LG 24MP59G
Case Green Z4
Audio Device(s) Realtek High Definition Audio
Power Supply Green 650 UK Gold
Software Windows 10™ Pro 64 bit

rtwjunkie

PC Gaming Enthusiast
Supporter
Joined
Jul 25, 2008
Messages
12,514 (3.03/day)
Location
Louisiana -Laissez les bons temps rouler!
System Name Bayou Devil
Processor Core i7-4790k 4.4Ghz @ 1.18v
Motherboard ASUS Z97 Deluxe
Cooling All air: 2x140mm Fractal exhaust; 3x 140mm Cougar Intake; Enermax T40F CPU cooler
Memory 2x 8GB Mushkin Redline DDR-3 1866
Video Card(s) MSI GTX 1080Ti Gaming X
Storage 1x 500 MX500 SSD; 1x 2TB WD Black; 2x 4TB WD Black;1x 2TB WD Green (eSATA)
Display(s) HP 27q 27" IPS @ 2560 x 1440
Case Fractal Design Define R4 Black w/Titanium front -windowed
Audio Device(s) Soundblaster Z
Power Supply Seasonic X-850
Mouse Coolermaster Sentinel III
Keyboard Logitech G610 Orion mechanical (Cherry Brown switches)
Software Windows 10 Pro 64-bit (Start10 & Fences 3.0 installed)
Most files just come from my camera from traveling Europe, so I didn't feel the need to scan them, but yeah I probably should. that is my bad. but is windows defender even good enough to detect an "infected file" or would i need something liek bitdefender or malwarebytes?
Personally, if that was how I was getting the files, I likely wouldn’t scan them either, as I don’t know how they could get infected.
 

sneekypeet

Super Moderator
Staff member
Joined
Apr 12, 2006
Messages
27,069 (5.45/day)
System Name His
Processor Intel i9 7920X
Motherboard Asus Prime X299 Deluxe
Cooling Corsair H115i RGB Platinum
Memory G.Skill TridentZ RGB 32GB @ 3600MHz
Video Card(s) nVidia RTX 2080ti
Storage Samsung 960 Pro / Crucial MX300 750GB / Seagate 1TB Spinner
Display(s) Samsung 55" 4K 60hz
Case Cooler Master Cosmos C700P (Inverted Layout)
Audio Device(s) Realtek on board > Sony Receiver > Cerwin Vega's
Power Supply Thermaltake TPSG 1050W
Mouse Always Changing
Keyboard Always Changing
Software Windows 10 Pro 64
So much wrong with this. Locking the thread.
 
Status
Not open for further replies.
Top