Arch Linux Security Advisory ASA-201906-22
=========================================
Severity: Critical
Date    : 2019-06-25
CVE-ID  : CVE-2019-5439 CVE-2019-12874
Package : vlc
Type    : arbitrary code execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-998

Summary
======
The package vlc before version 3.0.7.1-1 is vulnerable to arbitrary
code execution.

Resolution
=========
Upgrade to 3.0.7.1-1.

# pacman -Syu "vlc>=3.0.7.1-1"

The problems have been fixed upstream in version 3.0.7.1.

Workaround
=========
None.

Description
==========
- CVE-2019-5439 (arbitrary code execution)

VideoLAN VLC media player 3.0.6 and earlier has a out-of-bounds write
has been found in the ReadFrame function of the AVI decoder.

- CVE-2019-12874 (arbitrary code execution)

VideoLAN VLC media player 3.0.6 and earlier has a double-free in the
zlib_decompress_extra function of the Matroska demuxer in
modules/demux/mkv/util.cpp.

Impact
=====
A remote attacker is able to execute arbitrary code on the host by
providing a maliciously-crafted media file to VLC.

References
=========
https://www.videolan.org/security/sa1901.html
https://hackerone.com/reports/484398
;a=commit;h=81023659c7de5ac2637b4a879195efef50846102
https://security.archlinux.org/CVE-2019-5439
https://security.archlinux.org/CVE-2019-12874