Array index error in VLC media player 0.9.2 allows remote attackers to overwrite arbitrary memory and execute arbitrary code via an XSPF playlist file with a negative identifier tag, which passes a signed comparison. http://www.coresecurity.com/content/vlc-xspf-memory-corruption Please stabilize 0.9.4-r1 and mask/remove the older ones.
(In reply to comment #0) > Array index error in VLC media player 0.9.2 allows remote attackers to > overwrite arbitrary memory and execute arbitrary code via an XSPF playlist file > with a negative identifier tag, which passes a signed comparison. > > http://www.coresecurity.com/content/vlc-xspf-memory-corruption has this been confirmed on 0.8.6 ? i've asked around and it seems the vulnerable code wasn't in 0.8.6 > Please stabilize 0.9.4-r1 and mask/remove the older ones. could be an idea too, but for other reasons :p
I did not verify whether 0.8.6i was vulnerable or not, if you're sure that the vulnerable code isn't there, we can leave it in portage, of course - that's your decision. :)
(In reply to comment #2) > I did not verify whether 0.8.6i was vulnerable or not, if you're sure that the > vulnerable code isn't there, we can leave it in portage, of course - that's > your decision. :) i'm not sure, i'm just asking for confirmation; all the things i've read about this were talking only about 0.9.2 this might be interesting too: http://mailman.videolan.org/pipermail/vlc/2008-October/016125.html
I don't seem to be able to reproduce the issue in VLC 0.8.6i-r2 with CORE's reproducer.
CVE-2008-4558 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4558): Array index error in VLC media player 0.9.2 allows remote attackers to overwrite arbitrary memory and execute arbitrary code via an XSPF playlist file with a negative identifier tag, which passes a signed comparison.
So we've got no evidence that 0.8.x is affected, as such this is ~arch-only and we can close this bug. I quickly talked to aballier on IRC and he had no evidence of 0.8.x being affected either. Someone from security, please review this decision anyway, I don't want to be the only culprit. ;) We'll be handling stabilization of vlc-0.9.x for security reasons in bug 242740.
(In reply to comment #6) > Someone from security, please review this decision anyway, I don't want to be > the only culprit. ;) ACKed by Debian too, so I guess this is it for this bug.
