Joined: 12 May 2004
|Posted: Fri Jan 26, 2007 3:26 pm Post subject: [ GLSA 200701-24 ] VLC media player: Format string vulnerabi
|Gentoo Linux Security Advisory
Title: VLC media player: Format string vulnerability (GLSA 200701-24)
Date: January 26, 2007
VLC media player improperly handles format strings, allowing for the execution of arbitrary code.
VLC media player is a multimedia player for various audio and video formats.
Vulnerable: < 0.8.6-r1
Unaffected: >= 0.8.6-r1
Architectures: All supported architectures
Kevin Finisterre has discovered that when handling media locations, various functions throughout VLC media player make improper use of format strings.
An attacker could entice a user to open a specially crafted media location or M3U file with VLC media player, and execute arbitrary code on the system with the rights of the user running VLC media player.
There is no known workaround at this time.
All VLC media player users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/vlc-0.8.6-r1"