Some vulnerabilities have been reported in VLC Media Player, which can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to format string errors in the Ogg/Vorbis, Ogg/Theora, CDDA (CD Digital Audio), and SAP (Service Announce Protocol) plugins. These can be exploited to execute arbitrary code via a specially crafted .ogg or .ogm file (Vorbis/Theora), CDDB entry, or SAP/SDP message.

The vulnerabilities are reported in versions 0.8.6b and prior.

Solution
Update to version 0.8.6c.
Further details available in Customer Area

Provided and/or discovered by
David Thiel, iSEC Partners Inc for originally reporting the issue in the Ogg/Vorbis plugin.

Changelog
Further details available in Customer Area

Original Advisory
VideoLAN:
http://www.videolan.org/sa0702.html

iSec Partners:
http://www.isecpartners.com/advisories/2007-001-vlc.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area