From Secunia: Some vulnerabilities have been reported in VLC Media Player, which can be exploited by malicious people to potentially compromise a user's system. 1) A boundary error exists within the "ASF_ObjectDumpDebug()" function in modules/demux/asf/libasf.c. This can be exploited to cause a stack-based buffer overflow via a specially crafted ASF file. Fixed in http://git.videolan.org/?p=vlc.git;a=commit;h=dfe7084e8cc64e9b7a87cd37065b59cba2064823 2) A boundary error exists within the "AVI_ChunkDumpDebug_level()" function in modules/demux/avi/libavi.c. This can be exploited to cause a stack-based buffer overflow via a specially crafted AVI file. Fixed in http://git.videolan.org/?p=vlc.git;a=commit;h=861e374d03e6c60c7d3c98428c632fe3b9e371b2 3) A boundary error exists within the "__MP4_BoxDumpStructure()" function in modules/demux/mp4/libmp4.c. This can be exploited to cause a stack-based buffer overflow via a specially crafted MP4 file. Fixed in http://git.videolan.org/?p=vlc.git;a=commit;h=c5b02d011b8c634d041167f4d2936b55eca4d18d Successful exploitation of the vulnerabilities may allow execution of arbitrary code. Vulnerability #2 is confirmed in version 1.0.1. Other versions may also be affected.
all three will be fixed in 1.0.2 and these affect <1.0.2
1.0.2 is in the tree, and you have: http://www.videolan.org/security/sa0901.html
*** Bug 284780 has been marked as a duplicate of this bug. ***
go with 1.0.2 stable; arm still needs to rekeyword. now you latest ~arch is vulnerable to this.
x86 stable
20 Sep 2009; Markus Meier <maekke@gentoo.org> vlc-1.0.2.ebuild: add ~arm, bug #276278
amd64 stable
This triggers a whole slew of necessary updates: '>=media-sound/pulseaudio-0.9.11', '>=media-libs/libdvbpsi-0.1.6', '>=media-libs/schroedinger-1.0.6', 'media-libs/libtiger' You sure about those?
(In reply to comment #8) > This triggers a whole slew of necessary updates: > > '>=media-sound/pulseaudio-0.9.11', '>=media-libs/libdvbpsi-0.1.6', > '>=media-libs/schroedinger-1.0.6', 'media-libs/libtiger' > > You sure about those? > Yes, pulseaudio -> http://bugs.gentoo.org/284776 (alpha is CC'd) for others, follow the lead of amd64/x86 wrt keywords
Stable on alpha.
kate module compilation failed on ppc, bug 287423
I've been caught by bug 282390. Now, I need another ppc team member to confirm it's ppc-related... or stabilize vlc. Every dependencies are stable.
Unfortunately, this bug has been confirmed by another ppc dev.
sparc stable
*** Bug 282089 has been marked as a duplicate of this bug. ***
Actually, the ffmpeg bug isn't related to vlc in any way (vlc-1.0.2 doesn't need a newer ffmpeg) so vlc-1.0.2 is now stable for ppc. This was the last arch so, security team, you can fix the bug.
GLSA request was added to pending vlc GLSA by a3li.
<media-video/vlc-1.0.2 is no longer in tree.
Can one of our new scouts check if there is a CVE for this and request one if there is none?
CVE requested
This issue was resolved and addressed in GLSA 201411-01 at http://security.gentoo.org/glsa/glsa-201411-01.xml by GLSA coordinator Sean Amoss (ackle).
