Some vulnerabilities have been discovered in DivX Player, which can potentially be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to boundary errors in the processing of subtitle files (*.SRT, *.SUB). These can be exploited to cause stack-based buffer overflows via a specially crafted, overly long subtitle line contained in a malicious SRT or SUB file.

Successful exploitation may allow execution of arbitrary code, but requires that the user is tricked into opening a specially crafted SRT or SUB file.

The vulnerability is confirmed in DivX Player 6.7 (build 6.7.0.22). Other versions may also be affected.

Solution
Disable the automatic loading of subtitles. Do not open untrusted subtitles.

Provided and/or discovered by
securfrog

Additional information provided by Secunia Research.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://milw0rm.com/exploits/5453

Deep Links
Links available to Secunia VIM customers