CVE-2019-14778
Publication date 29 August 2019
Last updated 26 August 2025
Ubuntu priority
Cvss 3 Severity Score
Description
The mkv::virtual_segment_c::seek method of demux/mkv/virtual_segment.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free.
Status
| Package | Ubuntu Release | Status | 
|---|---|---|
| vlc | 25.10 questing | 
                                Not affected 
                                
                               | 
| 25.04 plucky | 
                                Not affected 
                                
                               | |
| 24.04 LTS noble | 
                                Not affected 
                                
                               | |
| 22.04 LTS jammy | 
                                Not affected 
                                
                               | |
| 20.04 LTS focal | 
                                Not affected 
                                
                               | |
| 18.04 LTS bionic | 
                                Fixed 3.0.8-0ubuntu18.04.1 
                                
                               | |
| 16.04 LTS xenial | 
                                Vulnerable 
                                
                               | |
| 14.04 LTS trusty | Ignored end of standard support | 
Severity score breakdown
| Parameter | Value | 
|---|---|
| Base score |  | 
| Attack vector | Local | 
| Attack complexity | Low | 
| Privileges required | None | 
| User interaction | Required | 
| Scope | Unchanged | 
| Confidentiality | High | 
| Integrity impact | High | 
| Availability impact | High | 
| Vector | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | 
References
Related Ubuntu Security Notices (USN)
- USN-4131-1
- VLC vulnerabilities
- 11 September 2019