CVE-2019-13602

HIGH 7.8CVE-2019-13602 · Published 14/07/2019 · updated 08/10/2026

In short

CVE-2019-13602 is a HIGH (CVSS 7.8) vulnerability affecting backports sle (opensuse), vlc media player (videolan).
Chance of exploitation in the next 30 days (EPSS): 2.1%, higher than 81.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
backports sle opensuse	`= 15.0`	No fix yet
vlc media player videolan	`≤ 3.0.7.1`	No fix yet

Description

An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.

References

lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2019-08/msg00037.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2019-08/msg00040.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2019-08/msg00081.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html · Mailing List
securityfocus.com/bid/109158 · Broken Link
git.videolan.org
git.videolan.org
seclists.org/bugtraq/2019/Aug/36 · Mailing List

More vulnerabilities in backports sle

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

backports sle

opensuse

= 15.0

No fix yet

vlc media player

videolan

≤ 3.0.7.1

No fix yet

More vulnerabilities in backports sle

See all →