MGASA-2015-0095

    Dashboard / Vulnerabilities / MGASA-2015-0095

    MGASA-2015-0095

    Published: 5 Mar 2015Last Modified: 16 Apr 2026
    Upstream:
    CVE-2014-6440

    Summary: Updated vlc package fixes security vulnerability

    Details: Updated vlc packages (2.1.6) are an upgrade with some fixes. Some of the problems fixed upstream were already fixed by a previous Mageia update to VLC (see the link to MGASA-2015-0053). VLC versions before 2.1.5 contain a vulnerability in the transcode module that may allow a corrupted stream to overflow buffers on the heap. With a non-malicious input, this could lead to heap corruption and a crash. However, under the right circumstances, a malicious attacker could potentially use this vulnerability to hijack program execution, and on some platforms, execute arbitrary code (CVE-2014-6440)

    References: https://advisories.mageia.org/MGASA-2015-0095.html, https://bugs.mageia.org/show_bug.cgi?id=15384, http://openwall.com/lists/oss-security/2015/03/05/2

    Affected packages

    Package

    Name: vlc

    Purl: pkg:rpm/mageia/vlc?arch=source&distro=mageia-4

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.1.6-1.0.mga4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    MGASA-2015-0095 | CVE-DB