vlc: CVE-2008-4558 code execution via crafted xspf playlist file

Debian Bug report logs - #502314
vlc: CVE-2008-4558 code execution via crafted xspf playlist file

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: submit@bugs.debian.org

Subject: vlc: CVE-2008-4558 code execution via crafted xspf playlist file

Date: Wed, 15 Oct 2008 16:30:44 +0200

[Message part 1 (text/plain, inline)]

Package: vlc
Severity: grave
Tags: security patch

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for vlc.

CVE-2008-4558[0]:
| Array index error in VLC media player 0.9.2 allows remote attackers to
| overwrite arbitrary memory and execute arbitrary code via an XSPF
| playlist file with a negative identifier tag, which passes a signed
| comparison.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4558
    http://security-tracker.debian.net/tracker/CVE-2008-4558

-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #10 received at 502314@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 502314@bugs.debian.org

Subject: Re: vlc: CVE-2008-4558 code execution via crafted xspf playlist file

Date: Wed, 15 Oct 2008 17:42:41 +0200

[Message part 1 (text/plain, inline)]

Hi,
forgot the patch.

http://git.videolan.org/?p=vlc.git;a=commit;h=6d3c22f29e650b0d10b2116fe3145194d20b8b56

-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #25 received at 502314-done@bugs.debian.org (full text, mbox, reply):

From: Christophe Mutricy <xtophe@chewa.net>

To: Nico Golde <nion@debian.org>, 502314-done@bugs.debian.org

Subject: Re: Bug#502314: vlc: CVE-2008-4558 code execution via crafted xspf playlist file

Date: Sat, 18 Oct 2008 17:18:01 +0200

Package: vlc
Version: 0.9.4-1

It was fixed upstream in 0.9.3

-- 
Xtophe

Le Wed 15 Oct 08 à 16:30 +0200, Nico Golde a écrit :
> Package: vlc
> Severity: grave
> Tags: security patch
> 
> Hi,
> the following CVE (Common Vulnerabilities & Exposures) id was
> published for vlc.
> 
> CVE-2008-4558[0]:
> | Array index error in VLC media player 0.9.2 allows remote attackers to
> | overwrite arbitrary memory and execute arbitrary code via an XSPF
> | playlist file with a negative identifier tag, which passes a signed
> | comparison.
> 
> If you fix the vulnerability please also make sure to include the
> CVE id in your changelog entry.
> 
> For further information see:
> 
> [0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4558
>     http://security-tracker.debian.net/tracker/CVE-2008-4558
> 
> -- 
> Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
> For security reasons, all text in this mail is double-rot13 encrypted.



> _______________________________________________
> pkg-multimedia-maintainers mailing list
> pkg-multimedia-maintainers@lists.alioth.debian.org
> http://lists.alioth.debian.org/mailman/listinfo/pkg-multimedia-maintainers

Send a report that this bug log contains spam.