Resource Exhaustion Affecting vlc package, versions <3.0.9.2-r0


Severity

Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.25% (64th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Resource Exhaustion vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-ALPINE321-VLC-8489742
  • published6 Dec 2024
  • disclosed24 Mar 2020

Introduced: 24 Mar 2020

CVE-2020-6079  (opens in a new tab)
CWE-400  (opens in a new tab)

How to fix?

Upgrade Alpine:3.21 vlc to version 3.0.9.2-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream vlc package and not the vlc package as distributed by Alpine. See How to fix? for Alpine:3.21 relevant fixed versions and status.

An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger this vulnerability through decoding of the domain name performed by rr_decode.

CVSS Scores

version 3.1