Stay away from VLC Player, critical flaw allows hackers in

[Space Lynx]

VideoLAN says VLC security flaw is fixed

The vulnerability was apparently due to a 3rd party library.

www.pcgamer.com

Saw this on Gizmodo and PCGamer and just thought I would share here, I have uninstalled it from my phone and PC.

 

[sam_86314]

Apparently the flaw only affects you if you open an infected .mkv file. It won't just randomly give someone access to your system. VideoLAN themselves can't even reproduce the issue.

I will continue to use VLC unless more comes of this.

 

[blobster21]

NVD - CVE-2019-13615

nvd.nist.gov

Current Description
VideoLAN VLC media player 3.0.7.1 has a heap-based buffer over-read in mkv::demux_sys_t::FreeUnused() in modules/demux/mkv/demux.cpp when called from mkv::Open in modules/demux/mkv/mkv.cpp.

and

#22474 (heap-buffer-overflow on demux_sys_t::FreeUnused) – VLC

trac.videolan.org

#22474 new defect
heap-buffer-overflow on demux_sys_t::FreeUnused

./vlc ../fuzz/heap-over-flow.mp4

and then

Sorry, but this bug is not reproducible and does not crash VLC at all.

#22474 (heap-buffer-overflow on demux_sys_t::FreeUnused) – VLC

trac.videolan.org

Windows: Not reproducible in 3.0.6 win64, 3.0.7.1 win64 or nightly 4.0.0-20190723-0832 win64 either.

#22474 (heap-buffer-overflow on demux_sys_t::FreeUnused) – VLC

trac.videolan.org

using the aformentioned tampered heap-over-flow.mp4, you can try it for yourself with the file provided below

heap-over-flow.mp4 on Ticket #22474 – Attachment – VLC

trac.videolan.org

 

[Space Lynx]

thanks for clarifying, I didn't read it all the way.

 

[Bill_Bright]

I didn't read it all the way.

Probably something that should be done before posting derogatory, sensationalized, and "the sky is falling" warnings that unjustly criticize the innocent.

I recommend the subject of this thread be edited before the false claim and recommendation is picked up by Bing Google and goes viral. VLC is a great, and safe program and there is no need for anyone to remove it, or stay away from it.

 

[Mazer]

Does it affect older releases too I'm on 3.0.6

 

[rtwjunkie]

Does it affect older releases too I'm on 3.0.6

It is a good idea to always update it whenever it notifies you. Fully half of their updates are closing discovered security holes, whether anyone has been successful or not.

Indeed, even just going to 3.07 has numerous security fixes.

VLC 3.0.7 includes more security fixes than ever thanks to the European Commission

Version 3.0.7 of VLC has been released, and while it may seem like a minor x.x.x update, it includes more security fixes than any other previous release -- including two high security issues.

betanews.com

The change log for the latest has a long list of updates:

VLC Media Player Free Latest Version 2019 | VideoLAN

VLC Media Player Free Latest Version 2019 - VLC Media Player For Windows 2019,VLC Media Player Free Download 32 Bit & 64 Bit 2019,VLC Media Player 2019.

videolanfree.com

 

[Space Lynx]

Probably something that should be done before posting derogatory, sensationalized, and "the sky is falling" warnings that unjustly criticize the innocent.

I recommend the subject of this thread be edited before the false claim and recommendation is picked up by Bing Google and goes viral. VLC is a great, and safe program and there is no need for anyone to remove it, or stay away from it.

not really, because I do use MKV files.... so.... yeah actually I still needed to remove it. so later alligator, have a good day. thanks for being a jerk though, much appreciated!

 

[rtwjunkie]

not really, because I do use MKV files.... so.... yeah actually I still needed to remove it. so later alligator, have a good day. thanks for being a jerk though, much appreciated!

The key being “infected” MKV flies though. I’m sure you are scanning files prior to playing them?

 

[Space Lynx]

The key being “infected” MKV flies though. I’m sure you are scanning files prior to playing them?

Most files just come from my camera from traveling Europe, so I didn't feel the need to scan them, but yeah I probably should. that is my bad. but is windows defender even good enough to detect an "infected file" or would i need something liek bitdefender or malwarebytes?

 

[shk021051]

mpc ftw

 

[rtwjunkie]

Most files just come from my camera from traveling Europe, so I didn't feel the need to scan them, but yeah I probably should. that is my bad. but is windows defender even good enough to detect an "infected file" or would i need something liek bitdefender or malwarebytes?

Personally, if that was how I was getting the files, I likely wouldn’t scan them either, as I don’t know how they could get infected.

 

[sneekypeet]

So much wrong with this. Locking the thread.