Security bugs are reported here via bugzilla

[Arwed von Merkatz <v.merkatz AT gmx.net>]

Summary           : URL format string injection in CDDA and VCDX plugins
Date              : 02 January 2007
Affected versions : VLC media player 0.8.6 down to 0.7.0
ID                : VideoLAN-SA-0701, MOAB-02-01-2007
CVE reference     : CVE-2007-0017

Details
=======
VLC media player CDDA (CD Digital Audio) and VCDX (Video CD) plugins are
prone to a C-style format string vulnerability when trying to open a
media resource location. The bug occurs when handling error and debug
messages from underlying library libcdio.

Because the VCDX plugins probes every media resource location unless
another plugin successfully opened the resource, almost any invalid
location can trigger the bug.

Impact
======
If successful, a malicious third party could use this vulnerability to
execute arbitrary code within the context of VLC media player (i.e.
acquire local user privileges on the vulnerable system), or crash the
player instance.

Threat mitigation
=================
Exploitation of this bug requires passing of a maliciously crafted media
location to VLC media player. While this normally comes from trustworthy
user input, it can also come from a playlist file (M3U and such), from
the network through a service discovery plugin (if enabled), or embedded
in a web page if VLC is installed as a browser plugin.

Affected packages
=================
vlc in test and stable grimoires.

Resolution
==========
All vlc users should upgrade to the latest version:
# scribe update
# cast -c vlc
OR
# scribe update
# sorcery queue-security
# cast --queue

References
==========
VLC security advisory http://www.videolan.org/sa0701.html

-- 
Arwed v. Merkatz                              Source Mage GNU/Linux developer
                                                    http://www.sourcemage.org

Attachment: pgpWvhEk7yisL.pgp
Description: PGP signature