| Summary: | media-video/vlc <0.9.4 XSPF index error (CVE-2008-4558) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Stefan Behte (RETIRED) <craig> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | media-video |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://www.coresecurity.com/content/vlc-xspf-memory-corruption | ||
| Whiteboard: | ~2? [noglsa] | ||
| Package list: | Runtime testing required: | --- | |
|
Description
Stefan Behte (RETIRED)
2008-10-16 21:36:43 UTC
(In reply to comment #0) > Array index error in VLC media player 0.9.2 allows remote attackers to > overwrite arbitrary memory and execute arbitrary code via an XSPF playlist file > with a negative identifier tag, which passes a signed comparison. > > http://www.coresecurity.com/content/vlc-xspf-memory-corruption has this been confirmed on 0.8.6 ? i've asked around and it seems the vulnerable code wasn't in 0.8.6 > Please stabilize 0.9.4-r1 and mask/remove the older ones. could be an idea too, but for other reasons :p I did not verify whether 0.8.6i was vulnerable or not, if you're sure that the vulnerable code isn't there, we can leave it in portage, of course - that's your decision. :) (In reply to comment #2) > I did not verify whether 0.8.6i was vulnerable or not, if you're sure that the > vulnerable code isn't there, we can leave it in portage, of course - that's > your decision. :) i'm not sure, i'm just asking for confirmation; all the things i've read about this were talking only about 0.9.2 this might be interesting too: http://mailman.videolan.org/pipermail/vlc/2008-October/016125.html I don't seem to be able to reproduce the issue in VLC 0.8.6i-r2 with CORE's reproducer. CVE-2008-4558 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4558): Array index error in VLC media player 0.9.2 allows remote attackers to overwrite arbitrary memory and execute arbitrary code via an XSPF playlist file with a negative identifier tag, which passes a signed comparison. So we've got no evidence that 0.8.x is affected, as such this is ~arch-only and we can close this bug. I quickly talked to aballier on IRC and he had no evidence of 0.8.x being affected either. Someone from security, please review this decision anyway, I don't want to be the only culprit. ;) We'll be handling stabilization of vlc-0.9.x for security reasons in bug 242740. (In reply to comment #6) > Someone from security, please review this decision anyway, I don't want to be > the only culprit. ;) ACKed by Debian too, so I guess this is it for this bug. |