Description
Multiple heap-based buffer overflows in cdg.c in the CDG decoder in VideoLAN VLC Media Player before 1.1.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted CDG video.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | vlc | 1.1.3-1squeeze2 | — |
| Debian 13 | vlc | 1.1.3-1squeeze2 | — |
| Debian 12 | vlc | 1.1.3-1squeeze2 | — |
References
- vlcmediaplayer-cdg-code-execution(64879) vdb-entry
- oval:org.mitre.oval:def:12460 vdb-entry signature
- ADV-2011-0185 vdb-entry
- [oss-security] 20110120 Re: CVE request: heap corruption in VLC media player mailing-list
- [oss-security] 20110119 CVE request: heap corruption in VLC media player mailing-list
- 45927 vdb-entry
- http://download.videolan.org/pub/videolan/vlc/1.1.6/vlc-1.1.6.tar.bz2
- http://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=f9b664eac0e1a7bceed9d7b5854fd9fc351b4aab