Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 375167 - <media-video/vlc-1.1.11 Parsing Vulnerabilities in RealMediaand AVI (CVE-2011-{2587,2588})
Summary: <media-video/vlc-1.1.11 Parsing Vulnerabilities in RealMediaand AVI (CVE-2011...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: http://www.securelist.com/en/advisori...
Whiteboard: B2 [glsa]
Keywords:
: 375845 (view as bug list)
Depends on:
Blocks:
 
Reported: 2011-07-14 10:25 UTC by Agostino Sarubbo
Modified: 2014-11-05 22:09 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2011-07-14 10:25:36 UTC 
$url
Comment 1 Ulenrich 2011-07-18 21:04:34 UTC 
Bad bug title - request would draw attention here?

Every should update this!
It is only a rename of the ebuild, followed by 
ebuild vlc-1.1.11.ebuild manifest
Comment 2 Hanno Böck gentoo-dev 2011-07-27 21:35:33 UTC 
*** Bug 375845 has been marked as a duplicate of this bug. ***
Comment 3 Agostino Sarubbo gentoo-dev 2011-08-04 18:24:28 UTC 
@security

1.1.11 is in tree, there is a reason because we cannot proceed?
Comment 4 Tim Sammut (RETIRED) gentoo-dev 2011-08-17 16:29:20 UTC 
Upstream advisories: 

http://www.videolan.org/security/sa1105.html
http://www.videolan.org/security/sa1106.html

Arches, please test and mark stable:
=media-video/vlc-1.1.11
Target keywords : "alpha amd64 ppc ppc64 sparc x86"
Comment 5 Agostino Sarubbo gentoo-dev 2011-08-17 17:08:53 UTC 
amd64 ok
Comment 6 Tony Vroon (RETIRED) gentoo-dev 2011-08-17 17:27:45 UTC 
+  17 Aug 2011; Tony Vroon <chainsaw@gentoo.org> vlc-1.1.11.ebuild:
+  Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo in
+  security bug #375167.
Comment 7 Kacper Kowalik (Xarthisius) (RETIRED) gentoo-dev 2011-08-18 16:57:01 UTC 
ppc/ppc64 stable
Comment 8 Agostino Sarubbo gentoo-dev 2011-08-18 17:13:48 UTC 
@x86

Works for me with following USE. Not tried more combination, Just installed on my laptop and works.

[ebuild   R    ] media-video/vlc-1.1.11  USE="alsa dbus mp3 mpeg ogg vorbis"
Comment 9 Paweł Hajdan, Jr. (RETIRED) gentoo-dev 2011-08-19 04:11:18 UTC 
x86 stable, thanks Agostino
Comment 10 Raúl Porcel (RETIRED) gentoo-dev 2011-08-27 17:36:28 UTC 
alpha/sparc stable
Comment 11 Agostino Sarubbo gentoo-dev 2011-08-27 17:41:12 UTC 
Thanks all, adding glsa in whiteboard.
Comment 12 Tim Sammut (RETIRED) gentoo-dev 2011-08-28 02:09:57 UTC 
Thanks, everyone. Added to existing GLSA request.
Comment 13 GLSAMaker/CVETool Bot gentoo-dev 2011-10-07 22:39:47 UTC 
CVE-2011-2588 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2588):
  Heap-based buffer overflow in the AVI_ChunkRead_strf function in libavi.c in
  the AVI demuxer in VideoLAN VLC media player before 1.1.11 allows remote
  attackers to cause a denial of service (application crash) or possibly
  execute arbitrary code via a crafted AVI media file.
Comment 14 GLSAMaker/CVETool Bot gentoo-dev 2011-10-07 22:40:04 UTC 
CVE-2011-2587 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2587):
  Heap-based buffer overflow in the DemuxAudioSipr function in real.c in the
  RealMedia demuxer in VideoLAN VLC media player 1.1.x before 1.1.11 allows
  remote attackers to cause a denial of service (application crash) or
  possibly execute arbitrary code via a crafted Real Media file.
Comment 15 GLSAMaker/CVETool Bot gentoo-dev 2014-11-05 22:09:00 UTC 
This issue was resolved and addressed in
 GLSA 201411-01 at http://security.gentoo.org/glsa/glsa-201411-01.xml
by GLSA coordinator Sean Amoss (ackle).