CVE-2021-25801

Published: 26 July 2021

A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file.

Priority

CVSS 3 base score: 7.1

Status

Package	Release	Status
vlc Launchpad, Ubuntu, Debian	bionic	Needs triage
	focal	Needs triage
	hirsute	Not vulnerable (3.0.12-3)
	impish	Not vulnerable
	jammy	Not vulnerable
	trusty	Does not exist
	upstream	Released (3.0.12-1)
	xenial	Ignored (out of standard support)

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25801
https://code.videolan.org/videolan/vlc-3.0/-/commit/f5f8cc3ab8825f178de3f6714bfbff8b3f293fd2 (v3.0.12)
https://code.videolan.org/videolan/vlc-3.0/-/commit/f5f8cc3ab8825f178de3f6714bfbff8b3f293fd2
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›

Security

CVE-2021-25801

Medium

Status

References

Join the discussion

Canonical is offering Extended Security Maintenance

Further reading