Bugzilla Bug 221959

CVE-2008-2147 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2147):
  Untrusted search path vulnerability in VideoLAN VLC before 0.9.0 allows local
  users to execute arbitrary code via a malicious library under the modules/ or
  plugins/ subdirectories of the current working directory.

should be fixed in 0.8.6g:

http://www.videolan.org/security/sa0805.html

note also that a previous problem with m3u wasn't completely fixed:
http://www.videolan.org/security/sa0804.html

Arches, please test and mark stable:
=media-video/vlc-0.8.6g
Target keywords : "alpha amd64 ppc release sparc x86"

From announcement

Security updates:
 * Removed VLC variable settings from Mozilla and ActiveX (CVE-2007-6683)
 * Removed loading plugins from the current directory (CVE-2008-2147)

http://mailman.videolan.org/pipermail/vlc-devel/2008-May/043400.html

Stable on alpha.

Tested =media-video/vlc-0.8.6g USE="X a52 aalib alsa dts dvd flac gnome hal mp3
mpeg musepack ncurses nsplugin ogg opengl png rtsp samba sdl sdl-image shout
speex stream svg theora truetype vcd vorbis x264 xinerama xulrunner xv (-3dfx)
(-altivec) -arts -avahi -bidi -cdda -cddb -corba -daap -dc1394 -debug
(-directfb) (-dvb) -esd -fbcon -ggi -gnutls -httpd -jack -libcaca -libnotify
(-lirc) -live -matroska (-modplug) -optimisememory -oss -seamonkey -skins
(-svga) -upnp -v4l -vlm (-win32codecs) -wxwindows -xml -xosd" on sparc.

Compiles fine, no test failures, no collisions, and everything still works.

# emerge --info
Portage 2.1.4.4 (default-linux/sparc/sparc64/2007.0, gcc-4.1.2, glibc-2.6.1-r0,
2.6.24-gentoo-r8 sparc64)
=================================================================
System uname: 2.6.24-gentoo-r8 sparc64 sun4u
Timestamp of tree: Sun, 18 May 2008 16:06:01 +0000
app-shells/bash:     3.2_p33
dev-lang/python:     2.4.4-r9
dev-python/pycrypto: 2.0.1-r6
sys-apps/baselayout: 1.12.11.1
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.13, 2.61-r1
sys-devel/automake:  1.5, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10.1
sys-devel/binutils:  2.18-r1
sys-devel/gcc-config: 1.4.0-r4
sys-devel/libtool:   1.5.26
virtual/os-headers:  2.6.24
ACCEPT_KEYWORDS="sparc"
CBUILD="sparc-unknown-linux-gnu"
CFLAGS="-mcpu=ultrasparc3 -mtune=ultrasparc3 -mvis -Wa,-Av8plusa -O2 -pipe
-ggdb"
CHOST="sparc-unknown-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config
/usr/kde/3.5/shutdown /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/fonts/fonts.conf /etc/gconf
/etc/revdep-rebuild /etc/terminfo /etc/texmf/web2c /etc/udev/rules.d"
CXXFLAGS="-mcpu=ultrasparc3 -mtune=ultrasparc3 -mvis -Wa,-Av8plusa -O2 -pipe
-ggdb"
DISTDIR="/tmp/distfiles"
FEATURES="collision-protect distlocks installsources metadata-transfer
parallel-fetch sandbox splitdebug strict test unmerge-orphans userfetch
userpriv usersandbox"
GENTOO_MIRRORS="http://distfiles.gentoo.org
http://distro.ibiblio.org/pub/linux/distributions/gentoo"
LANG="de_DE.UTF-8"
LDFLAGS="-Wl,-O1"
LINGUAS="de en"
MAKEOPTS="-j17"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --stats --timeout=180 --exclude=/distfiles
--exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/portage/local/layman/sunrise
/usr/portage/local/layman/gnash-cvs /usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="64bit 7zip X a52 aac aalib ace agg alsa artworkextra audacious
blender-game bluetooth bzip2 c++ caps clock-screen cups curl custom-cflags cvs
cxx dbus devhelp dga disk-partition divx doc dri dts dv dvd dvdread eds encode
evo exif fastcgi fat festival ffmpeg flac ftp fuse gd gif gimp gimpprint glade
gmedia gnome gnome-print gnomecanvas gpm grammar gtk hal hpn ieee1394 imap ipv6
ithreads javascript jpeg jpeg2k key-screen libsexy lyrics lzo mad mbrola
memcache midi mikmod mjpeg mng mouse mp2 mp3 mpeg mpeg2 mplayer musepack
musicbrainz nautilus ncurses network network-cron networking nls nptl nptlonly
nsplugin offensive ogg openal opengl openmp opera optimize-cflags pam parallel
pcre pdf png pnm ppds qt3support quicktime raw realmedia regex rtsp ruby samba
sasl sdl sdl-image search-screen shout slang smartcard smp sms sound soundex
source sourceview sparc speex spell sqlite3 ssl stream subversion svg symlink
taglib tagwriting theora threads tiff timidity tools truetype tta unicode usb
userlocales utils vcd vidix vim vim-syntax vim-with-x vorbis wma wmf wmp
wordexp x264 xanim xcb xfce xine xinerama xorg xulrunner xv xvid zlib"
ALSA_CARDS="CS4231" ALSA_PCM_PLUGINS="adpcm alaw copy dshare dsnoop extplug
file hooks ladspa lfloat linear meter mulaw multi null rate route share shm
asym dmix empty iec958 ioplug plug softvol" ELIBC="glibc"
INPUT_DEVICES="keyboard mouse" KERNEL="linux" LINGUAS="de en" USERLAND="GNU"
VIDEO_CARDS="mach64 fbdev mga"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL,
PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

amd64/x86 stable

sparc stable, thanks Friedrich

ppc stable

Fixed in release snapshot.

GLSA request filed.

GLSA 200807-13