vlc is vulnerable to arbitrary code execution. The vulnerability exists through a possible use-after-free in the Control function of demux/asf/asf.c
.
git.videolan.org/?p=vlc.git&a=search&h=refs/heads/master&st=commit&s=cve-2019
lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html
lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html
seclists.org/bugtraq/2019/Aug/36
security.gentoo.org/glsa/201909-02
usn.ubuntu.com/4131-1/
www.debian.org/security/2019/dsa-4504
www.videolan.org/security/sb-vlc308.html