VideoLAN VLC Media Player CDDA and VCDX Plugins URL Format String Injection Vulnerability
19 Apr. 2012
Summary
If successful, a malicious third party could use this vulnerability to execute arbitrary code within the context of VLC media player (i.e. acquire local user privileges on the vulnerable system), or crash the player instance.
Credit:
The information has been provided by Kevin Finisterre.
Vulnerable Systems:
* VLC media player 0.8.6 down to 0.7.0
VLC media player CDDA (CD Digital Audio) and VCDX (Video CD) plugins are prone to a C-style format string vulnerability when trying to open a media resource location. The bug occurs when handling error and debug messages from underlying library libcdio.
Because the VCDX plugins probes every media resource location unless another plugin successfully opened the resource, almost any invalid location can trigger the bug.
Vendor Status:
VideoLAN had issued an update for this vulnerability
