{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2019-08-14T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly. As a result, a heap-based buffer over-read can be triggered via a crafted .ogg file."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-04-29T11:06:07.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://git.videolan.org/?p=vlc.git&a=search&h=refs%2Fheads%2Fmaster&st=commit&s=cve-2019"}, {"name": "DSA-4504", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2019/dsa-4504"}, {"name": "20190821 [SECURITY] [DSA 4504-1] vlc security update", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "https://seclists.org/bugtraq/2019/Aug/36"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.videolan.org/security/sb-vlc308.html"}, {"name": "GLSA-201909-02", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201909-02"}, {"name": "USN-4131-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/4131-1/"}, {"name": "openSUSE-SU-2020:0545", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html"}, {"name": "openSUSE-SU-2020:0562", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2019-14437", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly. As a result, a heap-based buffer over-read can be triggered via a crafted .ogg file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://git.videolan.org/?p=vlc.git&a=search&h=refs%2Fheads%2Fmaster&st=commit&s=cve-2019", "refsource": "CONFIRM", "url": "http://git.videolan.org/?p=vlc.git&a=search&h=refs%2Fheads%2Fmaster&st=commit&s=cve-2019"}, {"name": "DSA-4504", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2019/dsa-4504"}, {"name": "20190821 [SECURITY] [DSA 4504-1] vlc security update", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/Aug/36"}, {"name": "https://www.videolan.org/security/sb-vlc308.html", "refsource": "CONFIRM", "url": "https://www.videolan.org/security/sb-vlc308.html"}, {"name": "GLSA-201909-02", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201909-02"}, {"name": "USN-4131-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4131-1/"}, {"name": "openSUSE-SU-2020:0545", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html"}, {"name": "openSUSE-SU-2020:0562", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T00:19:41.036Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://git.videolan.org/?p=vlc.git&a=search&h=refs%2Fheads%2Fmaster&st=commit&s=cve-2019"}, {"name": "DSA-4504", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://www.debian.org/security/2019/dsa-4504"}, {"name": "20190821 [SECURITY] [DSA 4504-1] vlc security update", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "https://seclists.org/bugtraq/2019/Aug/36"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.videolan.org/security/sb-vlc308.html"}, {"name": "GLSA-201909-02", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201909-02"}, {"name": "USN-4131-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/4131-1/"}, {"name": "openSUSE-SU-2020:0545", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html"}, {"name": "openSUSE-SU-2020:0562", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T17:34:16.212597Z", "id": "CVE-2019-14437", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T17:34:26.615Z"}}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-14437", "datePublished": "2019-08-29T17:30:37.000Z", "dateReserved": "2019-07-29T00:00:00.000Z", "dateUpdated": "2026-11-02T17:34:26.615Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://git.videolan.org/?p=vlc.git&a=search&h=refs%2Fheads%2Fmaster&st=commit&s=cve-2019", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://www.debian.org/security/2019/dsa-4504", "name": "DSA-4504", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"]}, {"url": "https://seclists.org/bugtraq/2019/Aug/36", "name": "20190821 [SECURITY] [DSA 4504-1] vlc security update", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"]}, {"url": "https://www.videolan.org/security/sb-vlc308.html", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://security.gentoo.org/glsa/201909-02", "name": "GLSA-201909-02", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"]}, {"url": "https://usn.ubuntu.com/4131-1/", "name": "USN-4131-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"]}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html", "name": "openSUSE-SU-2020:0545", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"]}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html", "name": "openSUSE-SU-2020:0562", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T00:19:41.036Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2019-14437", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T17:34:16.212597Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T17:34:22.838Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2019-08-14T00:00:00.000Z", "references": [{"url": "http://git.videolan.org/?p=vlc.git&a=search&h=refs%2Fheads%2Fmaster&st=commit&s=cve-2019", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://www.debian.org/security/2019/dsa-4504", "name": "DSA-4504", "tags": ["vendor-advisory", "x_refsource_DEBIAN"]}, {"url": "https://seclists.org/bugtraq/2019/Aug/36", "name": "20190821 [SECURITY] [DSA 4504-1] vlc security update", "tags": ["mailing-list", "x_refsource_BUGTRAQ"]}, {"url": "https://www.videolan.org/security/sb-vlc308.html", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://security.gentoo.org/glsa/201909-02", "name": "GLSA-201909-02", "tags": ["vendor-advisory", "x_refsource_GENTOO"]}, {"url": "https://usn.ubuntu.com/4131-1/", "name": "USN-4131-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"]}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html", "name": "openSUSE-SU-2020:0545", "tags": ["vendor-advisory", "x_refsource_SUSE"]}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html", "name": "openSUSE-SU-2020:0562", "tags": ["vendor-advisory", "x_refsource_SUSE"]}], "descriptions": [{"lang": "en", "value": "The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly. As a result, a heap-based buffer over-read can be triggered via a crafted .ogg file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2020-04-29T11:06:07.000Z"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "n/a"}]}, "product_name": "n/a"}]}, "vendor_name": "n/a"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "http://git.videolan.org/?p=vlc.git&a=search&h=refs%2Fheads%2Fmaster&st=commit&s=cve-2019", "name": "http://git.videolan.org/?p=vlc.git&a=search&h=refs%2Fheads%2Fmaster&st=commit&s=cve-2019", "refsource": "CONFIRM"}, {"url": "https://www.debian.org/security/2019/dsa-4504", "name": "DSA-4504", "refsource": "DEBIAN"}, {"url": "https://seclists.org/bugtraq/2019/Aug/36", "name": "20190821 [SECURITY] [DSA 4504-1] vlc security update", "refsource": "BUGTRAQ"}, {"url": "https://www.videolan.org/security/sb-vlc308.html", "name": "https://www.videolan.org/security/sb-vlc308.html", "refsource": "CONFIRM"}, {"url": "https://security.gentoo.org/glsa/201909-02", "name": "GLSA-201909-02", "refsource": "GENTOO"}, {"url": "https://usn.ubuntu.com/4131-1/", "name": "USN-4131-1", "refsource": "UBUNTU"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html", "name": "openSUSE-SU-2020:0545", "refsource": "SUSE"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html", "name": "openSUSE-SU-2020:0562", "refsource": "SUSE"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly. As a result, a heap-based buffer over-read can be triggered via a crafted .ogg file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2019-14437", "STATE": "PUBLIC", "ASSIGNER": "[email protected]"}}}}, "cveMetadata": {"cveId": "CVE-2019-14437", "state": "PUBLISHED", "dateUpdated": "2026-11-02T17:34:26.615Z", "dateReserved": "2019-07-29T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2019-08-29T17:30:37.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "[email protected]"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:videolan:vlc_media_player:3.0.7.1:*:*:*:*:*:*:*", "matchCriteriaId": "E70E115F-4E34-4944-BFB6-F523B54FC328", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly. As a result, a heap-based buffer over-read can be triggered via a crafted .ogg file."}, {"lang": "es", "value": "La funci\u00f3n xiph_SplitHeaders en el archivo modules/demux/xiph.h en VideoLAN VLC media player versi\u00f3n 3.0.7.1, no comprueba los l\u00edmites de la matriz apropiadamente. Como resultado, puede ser activada una lectura excesiva del b\u00fafer en la regi\u00f3n heap de la memoria por medio de un archivo .ogg dise\u00f1ado."}], "id": "CVE-2019-14437", "lastModified": "2026-11-02T18:18:24.270", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2019-14437", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T17:34:16.212597Z", "version": "2.0.3"}}]}, "published": "2019-08-29T18:15:12.127", "references": [{"source": "[email protected]", "tags": ["Patch"], "url": "http://git.videolan.org/?p=vlc.git&a=search&h=refs%2Fheads%2Fmaster&st=commit&s=cve-2019"}, {"source": "[email protected]", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html"}, {"source": "[email protected]", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html"}, {"source": "[email protected]", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://seclists.org/bugtraq/2019/Aug/36"}, {"source": "[email protected]", "url": "https://security.gentoo.org/glsa/201909-02"}, {"source": "[email protected]", "url": "https://usn.ubuntu.com/4131-1/"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2019/dsa-4504"}, {"source": "[email protected]", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.videolan.org/security/sb-vlc308.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://git.videolan.org/?p=vlc.git&a=search&h=refs%2Fheads%2Fmaster&st=commit&s=cve-2019"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://seclists.org/bugtraq/2019/Aug/36"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201909-02"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://usn.ubuntu.com/4131-1/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2019/dsa-4504"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.videolan.org/security/sb-vlc308.html"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-129"}], "source": "[email protected]", "type": "Primary"}]}

{}

{}