What’s Vulnerable › Vulnerabilities

CVE-2019-5459

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-07-30 · updated 2026-10-08
• Weakness: CWE-191

Description

An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read.

Affected products

• openSUSE Backports: sle-15
• openSUSE Backports Sle: 15.0-sp1
• openSUSE Leap: 15.0, 15.1
• VideoLAN VLC: before 3.0.7 — fixed in 3.0.7

How to fix

Upgrade to a fixed version: VideoLAN VLC 3.0.7. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00037.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00040.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00081.html
• https://hackerone.com/reports/502816
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00037.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00040.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00081.html
• https://hackerone.com/reports/502816

Get alerted when CVE-2019-5459 or the next vulnerability affects your stack