Use-after-free error in VLC Media Player - CVE-2018-11529

Vulnerability identifier: #VU13909

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-11529

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to use-after-free error when handling malicious input. A remote unauthenticated attacker can trick the victim into loading a specially crafted MKV file, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

VLC Media Player
Debian Linux
Ubuntu
Opensuse
vlc-plugin-pulse (Ubuntu package)
vlc-plugin-sdl (Ubuntu package)
vlc-nox (Ubuntu package)
vlc-plugin-zvbi (Ubuntu package)
vlc-plugin-svg (Ubuntu package)
vlc-plugin-notify (Ubuntu package)
vlc-plugin-jack (Ubuntu package)
vlc-plugin-fluidsynth (Ubuntu package)
libvlc5 (Ubuntu package)
vlc-data (Ubuntu package)
vlc (Ubuntu package)
libvlccore7 (Ubuntu package)
vlc-plugin-samba (Ubuntu package)
libvlccore8 (Ubuntu package)

Update to version 3.0.3.

VLC Media Player - update to 3.0.3
vlc-plugin-pulse (Ubuntu package) - update to 2.1.6-0ubuntu14.04.5+esm1
vlc-plugin-sdl (Ubuntu package) - addressed in versions 2.1.6-0ubuntu14.04.5+esm1, 2.2.2-5ubuntu0.16.04.5+esm1
vlc-nox (Ubuntu package) - addressed in versions 2.1.6-0ubuntu14.04.5+esm1, 2.2.2-5ubuntu0.16.04.5+esm1
vlc-plugin-zvbi (Ubuntu package) - addressed in versions 2.1.6-0ubuntu14.04.5+esm1, 2.2.2-5ubuntu0.16.04.5+esm1
vlc-plugin-svg (Ubuntu package) - addressed in versions 2.1.6-0ubuntu14.04.5+esm1, 2.2.2-5ubuntu0.16.04.5+esm1
vlc-plugin-notify (Ubuntu package) - addressed in versions 2.1.6-0ubuntu14.04.5+esm1, 2.2.2-5ubuntu0.16.04.5+esm1
vlc-plugin-jack (Ubuntu package) - addressed in versions 2.1.6-0ubuntu14.04.5+esm1, 2.2.2-5ubuntu0.16.04.5+esm1
vlc-plugin-fluidsynth (Ubuntu package) - addressed in versions 2.1.6-0ubuntu14.04.5+esm1, 2.2.2-5ubuntu0.16.04.5+esm1
libvlc5 (Ubuntu package) - addressed in versions 2.1.6-0ubuntu14.04.5+esm1, 2.2.2-5ubuntu0.16.04.5+esm1
vlc-data (Ubuntu package) - addressed in versions 2.1.6-0ubuntu14.04.5+esm1, 2.2.2-5ubuntu0.16.04.5+esm1
vlc (Ubuntu package) - addressed in versions 2.1.6-0ubuntu14.04.5+esm1, 2.2.2-5ubuntu0.16.04.5+esm1
libvlccore7 (Ubuntu package) - update to 2.1.6-0ubuntu14.04.5+esm1
vlc-plugin-samba (Ubuntu package) - update to 2.2.2-5ubuntu0.16.04.5+esm1
libvlccore8 (Ubuntu package) - update to 2.2.2-5ubuntu0.16.04.5+esm1

• Exploit #6349 - VLC media player 2.2.8 - Arbitrary Code Execution (PoC) (June 17, 2021)
• Exploit #6110 - VLC Media Player - MKV Use-After-Free (Metasploit) (June 17, 2021)
• Exploit #1529 - VLC Media Player MKV Use After Free (March 18, 2020)

• http://seclists.org/fulldisclosure/2018/Jul/28

• Remote code execution in Videolan VLC Media Player
• Debian update for vlc
• OpenSUSE Linux update for libjpeg-turbo
• OpenSUSE Linux update for libjpeg-turbo
• Ubuntu update for vlc