Videolabs Patches Code Execution, DoS Vulnerabilities in libmicrodns Library

guest · Mar 25, 2020

Videolabs Patches Code Execution, DoS Vulnerabilities in libmicrodns Library
March 25, 2020
https://www.securityweek.com/videol...ution-dos-vulnerabilities-libmicrodns-library

A company founded by VideoLAN members, Videolabs is the current editor of the VLC mobile applications and also an important contributor to the VLC media player. The libmicrodns mDNS resolver cross-platform library is used in the VLC media player for mDNS service discovery.

The most severe of the newly discovered vulnerabilities is an exploitable remote code execution bug in the label-parsing functionality of the library. It is tracked as CVE-2020-6072 and has a CVSS score of 9.8.

“When parsing compressed labels in mDNS messages, the `rr_decode` function's return value is not checked, leading to a double free that could be exploited to execute arbitrary code. An attacker can send an mDNS message to trigger this vulnerability,” Talos explains.
All of the remaining issues have a CVSS score of 7.5, but they impact different components of the library. [...]
Click to expand...

Talos found these vulnerabilities in version 0.1.0 of the libmicrodns library and reported them to the vendor in January. A fix was made available on March 20 with the release of version 0.1.1.
Click to expand...

Cisco Talos: Vulnerability Spotlight: Multiple vulnerabilities in Videolabs libmicrodns

Log in or Sign up

Videolabs Patches Code Execution, DoS Vulnerabilities in libmicrodns Library

guest Guest

Log in or Sign up

Videolabs Patches Code Execution, DoS Vulnerabilities in libmicrodns Library

guest Guest

Useful Searches