Timq has discovered a vulnerability in Crystal Player Pro, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error when parsing MLS files. This can be exploited to cause a heap-based buffer overflow via a specially crafted MLS file.

Successful exploitation allows execution of arbitrary code.

The vulnerability is confirmed in CrystalPlayer Professional version 1.98. Other versions may also be affected.

Solution
Do not open untrusted playlists.

Provided and/or discovered by
Discovered by Timq.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://milw0rm.com/exploits/4229

Deep Links
Links available to Secunia VIM customers