1. Gentoo Linux Security Advisory
| Advisory Reference | GLSA 200701-24 / vlc |
| Release Date | January 26, 2007 |
| Latest Revision | January 26, 2007: 01 |
| Impact | normal |
| Exploitable | remote |
| Package | Vulnerable versions | Unaffected versions | Architecture(s) |
| media-video/vlc | < 0.8.6-r1 | >= 0.8.6-r1 | All supported architectures |
Related bugreports: #159845
VLC media player improperly handles format strings, allowing for the execution of arbitrary code.
VLC media player is a multimedia player for various audio and video formats.
Kevin Finisterre has discovered that when handling media locations, various functions throughout VLC media player make improper use of format strings.
An attacker could entice a user to open a specially crafted media location or M3U file with VLC media player, and execute arbitrary code on the system with the rights of the user running VLC media player.
There is no known workaround at this time.
All VLC media player users should upgrade to the latest version:
Code Listing 3.1: Resolution |
# emerge --sync # emerge --ask --oneshot --verbose ">=media-video/vlc-0.8.6-r1" |