MGASA-2021-0227

    Dashboard / Vulnerabilities / MGASA-2021-0227

    MGASA-2021-0227

    Published: 8 Jun 2021Last Modified: 16 Apr 2026

    Summary: Updated vlc packages fix security vulnerabilities

    Details: A remote user could create a specifically crafted file that could trigger some various issues. It is possible to trigger a remote code execution through a specifically crafted playlist, and tricking the user into interacting with that playlist elements. It is also possible to trigger read or write buffer overflows with some crafted files or by a MITM attack on the automatic updater If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user. We updated VLC to latest version available.

    References: https://advisories.mageia.org/MGASA-2021-0227.html, https://bugs.mageia.org/show_bug.cgi?id=28930, https://www.videolan.org/security/sb-vlc3013.html, https://www.videolan.org/vlc/releases/3.0.13.html, https://code.videolan.org/videolan/vlc-3.0/-/raw/master/NEWS, https://git.videolan.org/?p=vlc/vlc-3.0.git;a=blob;f=NEWS;h=e5dd1855e797179ec3a0bee2cae4ac68705a70cc;hb=41878ff4f2a4b566cf0a1bd15f72037b2be98a18

    Affected packages

    Package

    Name: vlc

    Purl: pkg:rpm/mageia/vlc?arch=source&distro=mageia-7

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -3.0.14-1.mga7

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    MGASA-2021-0227 | CVE-DB