Bug 350933 – <media-video/vlc-1.1.6: Integer overflow in Real codec (CVE-2010-3907)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Tim Sammut (RETIRED) 2011-01-07 06:45:58 UTC]

From $URL:

Details

When parsing the header of an invalid Real Media file an integer overflow might occur then trigger a heap-based buffer overflow.
Impact

If successful, it is unknown whether a malicious third party might be able to trigger execution of arbitrary code. Successful exploitation of this bug can crash the proces of the media player. 

...

Solution

VLC media player 1.1.6 addresses this issue. Patches for older versions are available from the official VLC source code repositories.

[Comment 1 Alexis Ballier 2011-01-24 11:38:05 UTC]

vlc-1.1.6 should fix this

[Comment 2 Tim Sammut (RETIRED) 2011-01-24 14:48:47 UTC]

=media-video/vlc-1.1.6 is being stabilized in bug 352206.(In reply to comment #1)
> vlc-1.1.6 should fix this
> 

Great, thank you. =media-video/vlc-1.1.6 is being stabilized in bug 352206.

[Comment 3 GLSAMaker/CVETool Bot 2011-06-24 19:56:18 UTC]

CVE-2010-3907 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3907):
  Multiple integer overflows in real.c in the Real demuxer plugin in VideoLAN
  VLC Media Player before 1.1.6 allow remote attackers to cause a denial of
  service (application crash) or possibly execute arbitrary code via a zero
  i_subpackets value in a Real Media file, leading to a heap-based buffer
  overflow.

[Comment 4 GLSAMaker/CVETool Bot 2014-11-05 22:08:03 UTC]

This issue was resolved and addressed in
 GLSA 201411-01 at http://security.gentoo.org/glsa/glsa-201411-01.xml
by GLSA coordinator Sean Amoss (ackle).