VLC: Multiple vulnerabilities
1.
Gentoo Linux Security Advisory
Version Information
| Advisory Reference |
GLSA 200812-24 / vlc |
| Release Date |
December 24, 2008 |
| Latest Revision |
December 24, 2008: 01 |
| Impact |
normal |
| Exploitable |
remote |
| Package |
Vulnerable versions |
Unaffected versions |
Architecture(s) |
| media-video/vlc |
<
0.9.8a |
>=
0.9.8a |
All supported architectures
|
Related bugreports:
#245774, #249391
Synopsis
Multiple vulnerabilities in VLC may lead to the remote execution of
arbitrary code.
2.
Impact Information
Background
VLC is a cross-platform media player and streaming server.
Description
Tobias Klein reported the following vulnerabilities:
- A
stack-based buffer overflow when processing CUE image files in
modules/access/vcd/cdrom.c (CVE-2008-5032).
- A stack-based
buffer overflow when processing RealText (.rt) subtitle files in the
ParseRealText() function in modules/demux/subtitle.c
(CVE-2008-5036).
- An integer overflow when processing RealMedia
(.rm) files in the ReadRealIndex() function in real.c in the Real
demuxer plugin, leading to a heap-based buffer overflow
(CVE-2008-5276).
Impact
A remote attacker could entice a user to open a specially crafted CUE
image file, RealMedia file or RealText subtitle file, possibly
resulting in the execution of arbitrary code with the privileges of the
user running the application.
3.
Resolution Information
Workaround
There is no known workaround at this time.
Resolution
All VLC users should upgrade to the latest version:
Code Listing 3.1: Resolution |
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/vlc-0.9.8a"
|
4.
References
|
