VideoLAN Recursive plugin release vulnerability in Active X plugin
22 Oct. 2010
Summary
If successful, a malicious third party could use this vulnerability to overwrite memory zones and execute arbitrary code within the context of the VLC media player's ActiveX plugin (i.e. acquire local user privileges on the vulnerable system).
Credit:
The information has been provided by Ricardo Narvaja (Ricnar).
Vulnerable Systems:
* VLC media player 0.8.6 to 0.8.6c
The user may use VLC media player's Mozilla plugin for Mozilla Firefox or Seamonkey, which are not affected by this issue and provide the same features set.
Otherwise, websites from untrusted sources should not be opened.
VLC media player's ActiveX plugin is prone to a recursive plugin release vulnerability when being used within specifically crafted websites.
Vendor Status:
VideoLAN had issued an update for this vulnerability
