VLC Media Player XSPF Playlist Integer Overflow Memory Corruption Vulnerability

Bugtraq ID:	48171
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2011-2194
Remote:	Yes
Local:	No
Published:	Jun 07 2011 12:00AM
Updated:	Mar 19 2015 09:11AM
Credit:	Rocco Calvi from stratsec.
Vulnerable:	VideoLAN VLC media player 1.1.9 VideoLAN VLC media player 1.1.8 VideoLAN VLC media player 1.1.7 VideoLAN VLC media player 1.1.6 1 VideoLAN VLC media player 1.1.4 VideoLAN VLC media player 1.1.3 VideoLAN VLC media player 1.1.2 VideoLAN VLC media player 1.1.1 VideoLAN VLC media player 1.1 VideoLAN VLC media player 1.0.6 VideoLAN VLC media player 1.0.5 VideoLAN VLC media player 1.0.3 VideoLAN VLC media player 1.0.2 VideoLAN VLC media player 1.0.1 VideoLAN VLC media player 1.0 VideoLAN VLC media player 0.9.9 VideoLAN VLC media player 0.9.7 VideoLAN VLC media player 0.9.6 VideoLAN VLC media player 0.9.5 VideoLAN VLC media player 0.9.4 VideoLAN VLC media player 0.9.3 VideoLAN VLC media player 0.9.2 VideoLAN VLC media player 0.9.1 VideoLAN VLC media player 0.9 VideoLAN VLC media player 0.8.6 i VideoLAN VLC media player 0.8.6 h VideoLAN VLC media player 0.8.6 g VideoLAN VLC media player 0.8.6 d VideoLAN VLC media player 0.8.6 + Debian Linux 4.0 sparc + Debian Linux 4.0 s/390 + Debian Linux 4.0 powerpc + Debian Linux 4.0 mipsel + Debian Linux 4.0 mips + Debian Linux 4.0 m68k + Debian Linux 4.0 ia-64 + Debian Linux 4.0 ia-32 + Debian Linux 4.0 hppa + Debian Linux 4.0 arm + Debian Linux 4.0 amd64 + Debian Linux 4.0 alpha + Debian Linux 4.0 VideoLAN VLC media player 1.1.6 VideoLAN VLC media player 1.1.5 VideoLAN VLC media player 1.1.3 VideoLAN VLC media player 1.1.2 VideoLAN VLC media player 1.1.1 VideoLAN VLC media player 1.1.0 VideoLAN VLC media player 1.0.4 VideoLAN VLC media player 0.9.8a VideoLAN VLC media player 0.8.6f VideoLAN VLC media player 0.8.6e VideoLAN VLC media player 0.8.6c VideoLAN VLC media player 0.8.6b VideoLAN VLC media player 0.8.6a Pardus Linux 2011 0 Pardus Linux 2009 0 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	VideoLAN VLC media player 1.1.10

VLC Media Player XSPF Playlist Integer Overflow Memory Corruption Vulnerability

VLC media player is prone to a memory-corruption vulnerability because of an integer-overflow error in the XSPF playlist file parser.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Versions prior to VLC Media Player 1.1.10 are vulnerable.

VLC Media Player XSPF Playlist Integer Overflow Memory Corruption Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to open a malicious XSPF file with the vulnerable application.

The following sample file is available:

• /data/vulnerabilities/exploits/48171.xspf

VLC Media Player XSPF Playlist Integer Overflow Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references for more information.

VLC Media Player XSPF Playlist Integer Overflow Memory Corruption Vulnerability

References:

• VLC Homepage (VideoLAN)
  
• Security Advisory 1104 (VideoLAN)