Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 221959 - media-video/vlc <0.8.6g Multiple vulnerabilities (CVE-2008-2147, CVE-2008-????)
Summary: media-video/vlc <0.8.6g Multiple vulnerabilities (CVE-2008-2147, CVE-2008-????)
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
Whiteboard: A2 [glsa]
Depends on:
Reported: 2008-05-13 15:39 UTC by Robert Buchholz (RETIRED)
Modified: 2008-07-31 18:24 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Robert Buchholz (RETIRED) gentoo-dev 2008-05-13 15:39:01 UTC
CVE-2008-2147 (
  Untrusted search path vulnerability in VideoLAN VLC before 0.9.0 allows local
  users to execute arbitrary code via a malicious library under the modules/ or
  plugins/ subdirectories of the current working directory.
Comment 1 Alexis Ballier gentoo-dev 2008-05-18 15:35:51 UTC
should be fixed in 0.8.6g:

note also that a previous problem with m3u wasn't completely fixed:
Comment 2 Robert Buchholz (RETIRED) gentoo-dev 2008-05-18 15:49:27 UTC
Arches, please test and mark stable:
Target keywords : "alpha amd64 ppc release sparc x86"
Comment 3 Robert Buchholz (RETIRED) gentoo-dev 2008-05-18 15:56:14 UTC
From announcement

Security updates:
 * Removed VLC variable settings from Mozilla and ActiveX (CVE-2007-6683)
 * Removed loading plugins from the current directory (CVE-2008-2147)
Comment 4 Tobias Klausmann (RETIRED) gentoo-dev 2008-05-18 19:56:40 UTC
Stable on alpha.
Comment 5 Friedrich Oslage (RETIRED) gentoo-dev 2008-05-18 21:00:26 UTC
Tested =media-video/vlc-0.8.6g USE="X a52 aalib alsa dts dvd flac gnome hal mp3 mpeg musepack ncurses nsplugin ogg opengl png rtsp samba sdl sdl-image shout speex stream svg theora truetype vcd vorbis x264 xinerama xulrunner xv (-3dfx) (-altivec) -arts -avahi -bidi -cdda -cddb -corba -daap -dc1394 -debug (-directfb) (-dvb) -esd -fbcon -ggi -gnutls -httpd -jack -libcaca -libnotify (-lirc) -live -matroska (-modplug) -optimisememory -oss -seamonkey -skins (-svga) -upnp -v4l -vlm (-win32codecs) -wxwindows -xml -xosd" on sparc.

Compiles fine, no test failures, no collisions, and everything still works.

# emerge --info
Portage (default-linux/sparc/sparc64/2007.0, gcc-4.1.2, glibc-2.6.1-r0, 2.6.24-gentoo-r8 sparc64)
System uname: 2.6.24-gentoo-r8 sparc64 sun4u
Timestamp of tree: Sun, 18 May 2008 16:06:01 +0000
app-shells/bash:     3.2_p33
dev-lang/python:     2.4.4-r9
dev-python/pycrypto: 2.0.1-r6
sys-devel/autoconf:  2.13, 2.61-r1
sys-devel/automake:  1.5, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10.1
sys-devel/binutils:  2.18-r1
sys-devel/gcc-config: 1.4.0-r4
sys-devel/libtool:   1.5.26
virtual/os-headers:  2.6.24
CFLAGS="-mcpu=ultrasparc3 -mtune=ultrasparc3 -mvis -Wa,-Av8plusa -O2 -pipe -ggdb"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/revdep-rebuild /etc/terminfo /etc/texmf/web2c /etc/udev/rules.d"
CXXFLAGS="-mcpu=ultrasparc3 -mtune=ultrasparc3 -mvis -Wa,-Av8plusa -O2 -pipe -ggdb"
FEATURES="collision-protect distlocks installsources metadata-transfer parallel-fetch sandbox splitdebug strict test unmerge-orphans userfetch userpriv usersandbox"
LINGUAS="de en"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTDIR_OVERLAY="/usr/portage/local/layman/sunrise /usr/portage/local/layman/gnash-cvs /usr/local/portage"
USE="64bit 7zip X a52 aac aalib ace agg alsa artworkextra audacious blender-game bluetooth bzip2 c++ caps clock-screen cups curl custom-cflags cvs cxx dbus devhelp dga disk-partition divx doc dri dts dv dvd dvdread eds encode evo exif fastcgi fat festival ffmpeg flac ftp fuse gd gif gimp gimpprint glade gmedia gnome gnome-print gnomecanvas gpm grammar gtk hal hpn ieee1394 imap ipv6 ithreads javascript jpeg jpeg2k key-screen libsexy lyrics lzo mad mbrola memcache midi mikmod mjpeg mng mouse mp2 mp3 mpeg mpeg2 mplayer musepack musicbrainz nautilus ncurses network network-cron networking nls nptl nptlonly nsplugin offensive ogg openal opengl openmp opera optimize-cflags pam parallel pcre pdf png pnm ppds qt3support quicktime raw realmedia regex rtsp ruby samba sasl sdl sdl-image search-screen shout slang smartcard smp sms sound soundex source sourceview sparc speex spell sqlite3 ssl stream subversion svg symlink taglib tagwriting theora threads tiff timidity tools truetype tta unicode usb userlocales utils vcd vidix vim vim-syntax vim-with-x vorbis wma wmf wmp wordexp x264 xanim xcb xfce xine xinerama xorg xulrunner xv xvid zlib" ALSA_CARDS="CS4231" ALSA_PCM_PLUGINS="adpcm alaw copy dshare dsnoop extplug file hooks ladspa lfloat linear meter mulaw multi null rate route share shm asym dmix empty iec958 ioplug plug softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse" KERNEL="linux" LINGUAS="de en" USERLAND="GNU" VIDEO_CARDS="mach64 fbdev mga"
Comment 6 Dawid Węgliński (RETIRED) gentoo-dev 2008-05-19 08:40:01 UTC
amd64/x86 stable
Comment 7 Raúl Porcel (RETIRED) gentoo-dev 2008-05-19 11:31:52 UTC
sparc stable, thanks Friedrich
Comment 8 Tobias Scherbaum (RETIRED) gentoo-dev 2008-05-20 15:48:42 UTC
ppc stable
Comment 9 Peter Volkov (RETIRED) gentoo-dev 2008-05-21 09:50:42 UTC
Fixed in release snapshot.
Comment 10 Tobias Heinlein (RETIRED) gentoo-dev 2008-05-22 17:38:42 UTC
GLSA request filed.
Comment 11 Pierre-Yves Rofes (RETIRED) gentoo-dev 2008-07-31 18:24:51 UTC
GLSA 200807-13