Bug 353326 – <media-video/vlc-1.1.7: memory corruption, code execution (CVE-2011-0531)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Hanno Böck 2011-01-31 16:07:46 UTC]

From oss-security:
"When opening a malformed MKV (WebM or Matroska) file in VLC, it is
possible to corrupt memory and execute arbitrary code.
Proof-of-concept exploit code is available and may be made public
soon."

http://www.videolan.org/security/sa1102.html
http://git.videolan.org/?p=vlc.git;a=commit;h=59491dcedffbf97612d2c572943b56ee4289dd07

Upstream release 1.1.7 not yet available.

[Comment 1 Alexis Ballier 2011-02-01 01:28:25 UTC]

bumped to 1.1.7

[Comment 2 Tim Sammut (RETIRED) 2011-02-01 04:09:49 UTC]

(In reply to comment #1)
> bumped to 1.1.7
> 

Great, thank you.

Arches, please test and mark stable:
=media-video/vlc-1.1.7
Target keywords : "alpha amd64 ppc ppc64 sparc x86"

[Comment 3 Tim Sammut (RETIRED) 2011-02-01 04:10:35 UTC]

Adding, STABLEREQ; apologies for the bugspam.

[Comment 4 Agostino Sarubbo 2011-02-01 08:53:45 UTC]

amd64 ok

[Comment 5 Markos Chandras (RETIRED) 2011-02-01 18:38:20 UTC]

amd64 done. Thanks Agostino

[Comment 6 Kacper Kowalik (Xarthisius) (RETIRED) 2011-02-01 20:19:16 UTC]

ppc/ppc64 stable

[Comment 7 Andreas Schürch 2011-02-02 06:57:30 UTC]

Looks good to go on x86 also.
I've encountered two things, but they're no regressions...

USE="aalib -X"
make[5]: Entering directory `/var/tmp/portage/media-video/vlc-1.1.7/work/vlc-1.1.7/modules/video_output'
  CC     libaa_plugin_la-keythread.lo
  CC     libaa_plugin_la-aa.lo
  CC     libggi_plugin_la-ggi.lo
aa.c:42:4: error: #error Xlib required due to XInitThreads
  CC     libsvgalib_plugin_la-svgalib.lo
make[5]: *** [libaa_plugin_la-aa.lo] Error 1
------------
USE="sdl -X"
  CC     libfb_plugin_la-fb.lo
  CC     libggi_plugin_la-ggi.lo
  CC     libvout_sdl_plugin_la-sdl.lo
sdl.c:46:4: error: #error Xlib required due to XInitThreads
make[5]: *** [libvout_sdl_plugin_la-sdl.lo] Error 1

[Comment 8 Christian Faulhammer (RETIRED) 2011-02-04 23:38:40 UTC]

stable x86, thanks Andreas

[Comment 9 Tobias Klausmann (RETIRED) 2011-02-05 23:11:01 UTC]

Stable on alpha.

[Comment 10 Raúl Porcel (RETIRED) 2011-02-12 17:55:59 UTC]

sparc stable

[Comment 11 Tim Sammut (RETIRED) 2011-02-12 18:12:10 UTC]

Thanks folks. Added to existing GLSA request.

[Comment 12 GLSAMaker/CVETool Bot 2011-06-24 00:30:06 UTC]

CVE-2011-0531 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0531):
  demux/mkv/mkv.hpp in the MKV demuxer plugin in VideoLAN VLC media player
  1.1.6.1 and earlier allows remote attackers to cause a denial of service
  (crash) and execute arbitrary commands via a crafted MKV (WebM or Matroska)
  file that triggers memory corruption, related to "class mismatching" and the
  MKV_IS_ID macro.

[Comment 13 GLSAMaker/CVETool Bot 2014-11-05 22:08:29 UTC]

This issue was resolved and addressed in
 GLSA 201411-01 at http://security.gentoo.org/glsa/glsa-201411-01.xml
by GLSA coordinator Sean Amoss (ackle).