Maintainers of the popular open-source VLC media player patched two high-severity bugs Friday. The flaws were an out-of-bound write vulnerability and a stack-buffer-overflow bug. Developers behind the software, VideoLAN, said the patches were two of 33 fixes being pushed out to the media player and part of a new bug bounty program funded by European Commission.
“This high number of security issues is due to the sponsoring of a bug bounty program funded by the European Commission, during the Free and Open Source Software Audit (FOSSA) program,” wrote Jean-Baptiste Kempf, president of VideoLAN and open source developer in a post outlining the patches.
In January, the EU funded 14 bug bounty programs in hopes of keeping open source projects that EU institutions rely on secure. The program is maintained by the HackerOne bounty program facilitator.
Details are scant on the two high-severity bugs and how they could be exploited. Impacted is VLC 3.0.7 and the EU-FOSSA release of the player, along with code tied to the upcoming 4.0 release of the player.
“We just released VLC 3.0.7, a minor update of VLC branch 3.0.x. This release is a bit special, because it has more security issues fixed than any other version of VLC,” Kempf wrote.
The out-of-bound write vulnerability “is not in the VLC codebase, but in a dependency of VLC, the faad2 library, unmaintained, unfortunately,” according to Kempf. FAAD2 is an open source MPEG-4 and MPEG-2 AAC decoder and is licensed under GPLv2, according to Audiocoding.com.
The stack-buffer-overflow flaw is tied to VLC 4.0 and relates to the player’s Reliable Internet Stream Transport (RIST) module, slated to be released later this year and available in beta form now.
Kempf wrote that the VLC update also included the patching of 21 medium security issues and 20 low security issues.
“The medium security issues are mostly out-of-band reads, heap overflows, NULL-dereference and use-after-free security issues. Those issues should not be exploitable with ASLR, but are important anyway, because they can crash VLC,” he wrote.
The bulk of the vulnerabilities reported were found by a HackerOne user “ele7enxxh” who earned $13,260 for reporting 13 bugs unearthed in the VLC player platform.
Kempf said, beyond the bug fixes, the 3.0.7 update of VLC is minor. The bounty program stems back to FOSSA, first created by European Parliament member Julia Reda. Reda proposed FOSSA with the hopes of securing open source software, after the Heartbleed vulnerability was discovered in open source encryption library OpenSSL in 2014.
Besides VLC, the EU bounty program seeks vulnerabilities in such open-source projects such as Filezilla, Apache Kafka, Notepad++ and PuTTy. The program launched January 7, 2019.
Ransomware is on the rise: Don’t miss our free Threatpost webinar on the ransomware threat landscape, June 19 at 2 p.m. ET. Join Threatpost and a panel of experts as they discuss how to manage the risk associated with this unique attack type, with exclusive insights into new developments on the ransomware front and how to stay ahead of the attackers.
