g_ has discovered some vulnerabilities in VLC Media Player, which potentially can be exploited by malicious people to compromise a user's system.

1) An integer overflow error exists within the "Open()" function in modules/demux/tta.c. This can be exploited to cause a heap-based buffer overflow via specially crafted TTA data.

2) A signedness error exists within the "mms_ReceiveCommand()" function in modules/access/mms/mmstu.c. This can be exploited to cause a heap-based buffer overflow by tricking the user into opening a specially crafted MMST stream.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

The vulnerabilities are confirmed in version 0.8.6i. Other versions may also be affected.

Solution
Update to version 0.9.0 or later.
Further details available in Customer Area

Provided and/or discovered by
g_, Orange Bat

Changelog
Further details available in Customer Area

Original Advisory
VLC Media Player:
http://www.videolan.org/developers/vlc/NEWS
http://www.videolan.org/security/sa0807.html

Orange Bat:
http://www.orange-bat.com/adv/2008/adv.08.16.txt
http://www.orange-bat.com/adv/2008/adv.08.24.txt

Deep Links
Links available in Customer Area