CVE-2008-2147 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2147): Untrusted search path vulnerability in VideoLAN VLC before 0.9.0 allows local users to execute arbitrary code via a malicious library under the modules/ or plugins/ subdirectories of the current working directory.
should be fixed in 0.8.6g: http://www.videolan.org/security/sa0805.html note also that a previous problem with m3u wasn't completely fixed: http://www.videolan.org/security/sa0804.html
Arches, please test and mark stable: =media-video/vlc-0.8.6g Target keywords : "alpha amd64 ppc release sparc x86"
From announcement Security updates: * Removed VLC variable settings from Mozilla and ActiveX (CVE-2007-6683) * Removed loading plugins from the current directory (CVE-2008-2147) http://mailman.videolan.org/pipermail/vlc-devel/2008-May/043400.html
Stable on alpha.
Tested =media-video/vlc-0.8.6g USE="X a52 aalib alsa dts dvd flac gnome hal mp3 mpeg musepack ncurses nsplugin ogg opengl png rtsp samba sdl sdl-image shout speex stream svg theora truetype vcd vorbis x264 xinerama xulrunner xv (-3dfx) (-altivec) -arts -avahi -bidi -cdda -cddb -corba -daap -dc1394 -debug (-directfb) (-dvb) -esd -fbcon -ggi -gnutls -httpd -jack -libcaca -libnotify (-lirc) -live -matroska (-modplug) -optimisememory -oss -seamonkey -skins (-svga) -upnp -v4l -vlm (-win32codecs) -wxwindows -xml -xosd" on sparc. Compiles fine, no test failures, no collisions, and everything still works. # emerge --info Portage 2.1.4.4 (default-linux/sparc/sparc64/2007.0, gcc-4.1.2, glibc-2.6.1-r0, 2.6.24-gentoo-r8 sparc64) ================================================================= System uname: 2.6.24-gentoo-r8 sparc64 sun4u Timestamp of tree: Sun, 18 May 2008 16:06:01 +0000 app-shells/bash: 3.2_p33 dev-lang/python: 2.4.4-r9 dev-python/pycrypto: 2.0.1-r6 sys-apps/baselayout: 1.12.11.1 sys-apps/sandbox: 1.2.18.1-r2 sys-devel/autoconf: 2.13, 2.61-r1 sys-devel/automake: 1.5, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10.1 sys-devel/binutils: 2.18-r1 sys-devel/gcc-config: 1.4.0-r4 sys-devel/libtool: 1.5.26 virtual/os-headers: 2.6.24 ACCEPT_KEYWORDS="sparc" CBUILD="sparc-unknown-linux-gnu" CFLAGS="-mcpu=ultrasparc3 -mtune=ultrasparc3 -mvis -Wa,-Av8plusa -O2 -pipe -ggdb" CHOST="sparc-unknown-linux-gnu" CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/config" CONFIG_PROTECT_MASK="/etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/revdep-rebuild /etc/terminfo /etc/texmf/web2c /etc/udev/rules.d" CXXFLAGS="-mcpu=ultrasparc3 -mtune=ultrasparc3 -mvis -Wa,-Av8plusa -O2 -pipe -ggdb" DISTDIR="/tmp/distfiles" FEATURES="collision-protect distlocks installsources metadata-transfer parallel-fetch sandbox splitdebug strict test unmerge-orphans userfetch userpriv usersandbox" GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/linux/distributions/gentoo" LANG="de_DE.UTF-8" LDFLAGS="-Wl,-O1" LINGUAS="de en" MAKEOPTS="-j17" PKGDIR="/usr/portage/packages" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/portage/local/layman/sunrise /usr/portage/local/layman/gnash-cvs /usr/local/portage" SYNC="rsync://rsync.gentoo.org/gentoo-portage" USE="64bit 7zip X a52 aac aalib ace agg alsa artworkextra audacious blender-game bluetooth bzip2 c++ caps clock-screen cups curl custom-cflags cvs cxx dbus devhelp dga disk-partition divx doc dri dts dv dvd dvdread eds encode evo exif fastcgi fat festival ffmpeg flac ftp fuse gd gif gimp gimpprint glade gmedia gnome gnome-print gnomecanvas gpm grammar gtk hal hpn ieee1394 imap ipv6 ithreads javascript jpeg jpeg2k key-screen libsexy lyrics lzo mad mbrola memcache midi mikmod mjpeg mng mouse mp2 mp3 mpeg mpeg2 mplayer musepack musicbrainz nautilus ncurses network network-cron networking nls nptl nptlonly nsplugin offensive ogg openal opengl openmp opera optimize-cflags pam parallel pcre pdf png pnm ppds qt3support quicktime raw realmedia regex rtsp ruby samba sasl sdl sdl-image search-screen shout slang smartcard smp sms sound soundex source sourceview sparc speex spell sqlite3 ssl stream subversion svg symlink taglib tagwriting theora threads tiff timidity tools truetype tta unicode usb userlocales utils vcd vidix vim vim-syntax vim-with-x vorbis wma wmf wmp wordexp x264 xanim xcb xfce xine xinerama xorg xulrunner xv xvid zlib" ALSA_CARDS="CS4231" ALSA_PCM_PLUGINS="adpcm alaw copy dshare dsnoop extplug file hooks ladspa lfloat linear meter mulaw multi null rate route share shm asym dmix empty iec958 ioplug plug softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse" KERNEL="linux" LINGUAS="de en" USERLAND="GNU" VIDEO_CARDS="mach64 fbdev mga" Unset: CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
amd64/x86 stable
sparc stable, thanks Friedrich
ppc stable
Fixed in release snapshot.
GLSA request filed.
GLSA 200807-13
