Summary: | <media-video/vlc-1.1.8: Vulnerabilities handling .AMV and .NSV files (CVE-2010-{3275,3276}) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Tim Sammut (RETIRED) <underling> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | normal | CC: | media-video |
Priority: | Normal | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | http://www.coresecurity.com/content/vlc-vulnerabilities-amv-nsv-files | ||
Whiteboard: | B2 [glsa] | ||
Package list: | Runtime testing required: | --- |
Description
Tim Sammut (RETIRED)
![]() Upstream has released 1.1.8, which the third-party advisory at $URL says is fixed. I do not see a videolan.org advisory yet. 1.1.8 in tree (In reply to comment #2) > 1.1.8 in tree Great, thanks. Arches, please test and mark stable: =media-video/vlc-1.1.8 Target keywords : "alpha amd64 ppc ppc64 sparc x86" Tested on x86. It looks quite good here, but USE="-X" fails a bit ugly if USE="aalib" and/or USE="sdl". (In reply to comment #3) > Arches, please test and mark stable: > =media-video/vlc-1.1.8 > Target keywords : "alpha amd64 ppc ppc64 sparc x86" Arches, please test also media-libs/schroedinger-1.0.10 is pulled in by USE="schroedinger" thanks (In reply to comment #5) > Arches, please test also media-libs/schroedinger-1.0.10 is pulled in by > USE="schroedinger" Ah, you're right, i forgot to mention it! I already tested schroedinger on x86. amd64 ok amd64 done, thanks Agostino ppc done ppc64 stable x86 stable, thanks Andreas. Please file bugs for the detected issues. I think they shouldn't block a security stabilization, but still they should get fixed. alpha/sparc stable Thanks, everyone. Added to existing GLSA request. CVE-2010-3276 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3276): libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an NSV file. CVE-2010-3275 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3275): libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an AMV file, related to a "dangling pointer vulnerability." This issue was resolved and addressed in GLSA 201411-01 at http://security.gentoo.org/glsa/glsa-201411-01.xml by GLSA coordinator Sean Amoss (ackle). |