Bug 161828 – media-video/vlc 0.8.6a Denial of Service

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Executioner 2007-01-12 21:55:22 UTC]

Looks like a pretty basic DoS

Reproducible: Didn't try

[Comment 1 Executioner 2007-01-12 22:00:37 UTC]

Not sure if this is versions < 0.8.6a or just 0.8.6a

[Comment 2 Tavis Ormandy (RETIRED) 2007-01-12 23:05:17 UTC]

This looks like more than a DoS, despite the very lame exploit ;)

I get what looks like a double free() in libasf.

[Comment 3 Matthias Geerdsen (RETIRED) 2007-01-26 13:00:35 UTC]

adding herd

can someone verify, if 0.8.6 is vulnerable by this

[Comment 4 Diego Elio Pettenò (RETIRED) 2007-01-26 16:10:29 UTC]

0.8.6-r1 is the same as 0.8.6a for Linux (there were a few changes for OSX, so I didn't spend time getting a new tarball).

So yeah.

[Comment 5 Diego Elio Pettenò (RETIRED) 2007-01-26 19:57:18 UTC]

I've added a 0.8.6_p18636, that comes out of the 0.8.6-bugfix branch of VLC, that solves this issue and a few more according to upstream.

[Comment 6 Raphael Marichez (Falco) (RETIRED) 2007-01-31 21:43:33 UTC]

Hi,

usually we don't handle client-side DoS except in severe cases. Switching in "auditing" in order to know if this is only a DoS or something which can be exploited for code injection...

Feel free to comment on this bug!

[Comment 7 Raphael Marichez (Falco) (RETIRED) 2007-02-10 19:10:00 UTC]

i can't find any reference to anything else that a simple DoS.

Closing since the fixed ebuild is already in the tree, feel free to reopen if you disagree.