CVE-2021-25801

Published: 26 July 2021

A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file.

Priority

CVSS 3 base score: 7.1

Status

Package	Release	Status
vlc Launchpad, Ubuntu, Debian	bionic	Needs triage
	focal	Needs triage
	hirsute	Not vulnerable (3.0.12-3)
	impish	Not vulnerable
	jammy	Not vulnerable
	kinetic	Not vulnerable
	trusty	Needs triage
	upstream	Released (3.0.12-1)
	xenial	Needs triage

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25801
https://code.videolan.org/videolan/vlc-3.0/-/commit/f5f8cc3ab8825f178de3f6714bfbff8b3f293fd2 (v3.0.12)
https://code.videolan.org/videolan/vlc-3.0/-/commit/f5f8cc3ab8825f178de3f6714bfbff8b3f293fd2
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›

Security

CVE-2021-25801

Medium

Status

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Further reading