oss-security - CVE request: VLC <1.0.6 Multiple issues

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100422203033.54cd90f7@mail.a3li.li>
Date: Thu, 22 Apr 2010 20:30:33 +0200
From: Alex Legler <a3li@...too.org>
To: oss-security@...ts.openwall.com
Subject: CVE request: VLC <1.0.6 Multiple issues

Hi,

in case there was no request from upstream yet:

VLC media player suffers from various vulnerabilities when attempting
to parse malformatted or overly long byte streams.

* Heap buffer overflow vulnerability in A/52, DTS and MPEG Audio
  decoders
* Invalid memory access in AVI, ASF, Matroska (MKV)
  demuxers 
* Invalid memory access in XSPF playlist parser
* Inavlid memory access in ZIP archive decompressor
* Heap buffer overflow in RTMP access

http://www.videolan.org/security/sa1003.html

Thanks,
Alex

-- 
Alex Legler | Gentoo Security / Ruby
a3li@...too.org | a3li@...ber.ccc.de

Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.