AOH :: HP Unsorted V :: TB11378.HTM

VLC 0.8.6b format string vulnerability & integer overflow
VLC 0.8.6b format string vulnerability & integer overflow
VLC 0.8.6b format string vulnerability & integer overflow

iSEC Partners Security Advisory - 2007-001-vlc 

VLC 0.8.6b format string vulnerability & integer overflow

Vendor: VideoLan
Vendor URL: 
Systems Affected: Confirmed on Windows XP, FreeBSD 6.2, MacOS X 10.4
Severity: High (memory access violations, potential code execution)
Author: David Thiel 

Vendor notified: 2007-06-05
Public release: 2007-06-21
Advisory URL: 
Vendor Advisory: 


VLC is vulnerable to a format string attack in the parsing of Vorbis
comments in Ogg Vorbis and Ogg Theora files, CDDA data or SAP/SDP
service discovery messages. Additionally, there are two errors in the
handling of wav files, one a denial of service due to an uninitialized
variable, and one integer overflow in sampling frequency calculations.


The input_vaControl function in input.c calls vasprintf() with an
externally-supplied format string, as specified in the value of a Vorbis
comment. This can lead to arbitrary code execution.

An excessively large sample rate causes an integer overflow, resulting
in a SEGV in __status_Update in stats.c.

An uninitialized i_nb_resamplers in input.c can cause a crash during 
audio stream processing.

Fix Information:

These issues are fixed version 0.8.6c. Workarounds for previous versions
are documented in the vendor advisory.

About iSEC Partners:
iSEC Partners is a full-service security consulting firm that provides
penetration testing, secure systems development, security education
and software design verification.

115 Sansome Street, Suite 1005
San Francisco, CA 94104
Phone: (415) 217-0052

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH
We do not send spam. If you have received spam bearing an email address, please forward it with full headers to