Two vulnerabilities have been reported in VLC Media Player, which potentially can be exploited by malicious people to compromise a user's system.

1) A boundary error in the processing of TY files can be exploited to cause a stack-based buffer overflow.

2) An integer overflow error in the processing of TY files can be exploited to cause a heap-based buffer overflow.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

The vulnerabilities are reported in versions 0.9.0 through 0.9.4. Other versions may also be affected.

Solution
Update to version 0.9.5.
Further details available in Customer Area

Provided and/or discovered by
1) The vendor credits Tobias Klein.
2) Reported by the vendor.

Changelog
Further details available in Customer Area

Original Advisory
VideoLAN:
http://www.videolan.org/security/sa0809.html
http://git.videolan.org/?p=vlc.git;a=commitdiff;h=d859e6b9537af2d7326276f70de25a840f554dc3

Tobias Klein:
http://www.trapkit.de/advisories/TKADV2008-010.txt

Deep Links
Links available in Customer Area