Secunia Research has discovered two vulnerabilities in VCDGear, which can be exploited by malicious people to compromise a user's system.

1) A boundary error when parsing tags in .CUE files can be exploited to cause a stack-based buffer overflow via a specially crafted .CUE file containing an overly long tag.

2) A boundary error when processing "TRACK" information in .CUE files can be exploited to cause a stack-based buffer overflow via a specially crafted .CUE file containing an overly long track type.

Successful exploitation allows execution of arbitrary code when a user loads a malicious .CUE file.

The vulnerabilities are confirmed in version 3.55. Other versions may also be affected.

Solution
Do not open untrusted .CUE files.

Provided and/or discovered by
Carsten Eiram, Secunia Research.

Original Advisory
Secunia Research:
http://secunia.com/secunia_research/2007-51/

Deep Links
Links available to Secunia VIM customers