EXPOSURES › CVE-2018-19857
CVE-2018-19857
CRITICAL
DETAIL
SourceNVD · cve
Published2018-12-05
CVSS9.1
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2018-19857 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
DESCRIPTION
The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer when processing magic cookies in CAF files, because a ReadKukiChunk() cast converts a return value to an unsigned int even if that value is negative. This could result in a denial of service and/or a potential infoleak.
SENTIMENT · TRUSTED SOURCES
synthesis
neutral
+0.00
No coverage from trusted security press or authorities; only NVD technical summary and a failed DuckDuckGo bridge query.
Neutral technical summary; no sentiment toward vendor.
"The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer when processing magic cookies in CAF files, because a ReadKukiChunk() cast converts a return value to an unsigned int even if that value is negative. This could result in a denial of service and/or a potential infoleak."
No usable content; bridge error.
AFFECTED FEDRAMP PRODUCTS · 0
No correlated FedRAMP products.