Critical flaw in VLC Media Player Found

A German cybersecurity agency, CERT-Bund, which is responsible for organizing the country’s response to any computer emergencies, has recently discovered what it describes as a critical flaw in the popular VLC Media Player. VLC is known to be a highly compatible media player, and thus boasts an impressive total downloads of over 3 billion, making this vulnerability all the more dangerous. CERT-Bund classified the vulnerability, officially logged as CVE-2019-13615, to be a “High” (Level 4) exploit, which is the second-highest risk assessment level by the agency.

The exploit is rather nasty and allows attackers to not only execute code remotely but also allows for unauthorized disclosure of information, unauthorized modification of files and disruption of service. VLC is currently in the process of creating a fix, which can be seen on its website here. However, the ticket shows work on the fix is only 60% complete and there’s no ETA on when it might be complete.

Read more at NIST