Secunia

Multiple vulnerabilities have been reported in VLC Media Player, which can be exploited by malicious people to potentially compromise a user's system.

1) An error in the A/52 audio decoder can be exploited to cause a heap-based buffer overflow.

2) An error in the DTS audio decoder can be exploited to cause a heap-based buffer overflow.

3) An error in the MPEG audio decoder can be exploited to cause a heap-based buffer overflow.

4) An error in the AVI demuxer can be exploited to trigger an access to invalid memory.

5) An error in the ASF demuxer can be exploited to trigger an access to invalid memory.

6) An error in the Matroska demuxer can be exploited to trigger an access to invalid memory.

7) An error when processing XSPF playlists can be exploited to trigger an access to invalid memory.

8) A use-after-free error when attempting to create a playlist of the contents of a malformed zip archive can be exploited to reference already freed memory via a specially crafted file with an arbitrary file extension.

9) An error in the RTMP implementation can be exploited to cause a heap-based buffer overflow.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code, but requires that the user is tricked into opening a specially crafted file.

The vulnerabilities are reported in versions prior to 1.0.6.

Solution
Update to version 1.1.0.
Further details available in Customer Area

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available in Customer Area

Original Advisory
VideoLAN-SA-1003:
http://www.videolan.org/security/sa1003.html

Technical Analysis
Further details available in Customer Area

Deep Links
Links available in Customer Area