[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 22 Oct 2008 12:57:04 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE id request: vlc
======================================================
Name: CVE-2008-4654
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4654
Reference: BUGTRAQ:20081020 [TKADV2008-010] VLC media player TiVo ty Processing Stack Overflow Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/497587/100/0/threaded
Reference: MLIST:[oss-security] 20081019 CVE id request: vlc
Reference: URL:http://www.openwall.com/lists/oss-security/2008/10/19/2
Reference: MISC:http://www.trapkit.de/advisories/TKADV2008-010.txt
Reference: CONFIRM:http://git.videolan.org/?p=vlc.git;a=commit;h=fde9e1cc1fe1ec9635169fa071e42b3aa6436033
Reference: CONFIRM:http://git.videolan.org/?p=vlc.git;a=commitdiff;h=26d92b87bba99b5ea2e17b7eaa39c462d65e9133
Reference: CONFIRM:http://www.videolan.org/security/sa0809.html
Reference: CONFIRM:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=502726
Reference: BID:31813
Reference: URL:http://www.securityfocus.com/bid/31813
Reference: FRSIRT:ADV-2008-2856
Reference: URL:http://www.frsirt.com/english/advisories/2008/2856
Reference: SECUNIA:32339
Reference: URL:http://secunia.com/advisories/32339
Reference: XF:vlcmediaplayer-ty-bo(45960)
Reference: URL:http://xforce.iss.net/xforce/xfdb/45960
Stack-based buffer overflow in the parse_master function in the Ty
demux plugin (modules/demux/ty.c) in VLC Media Player 0.9.0 through
0.9.4 allows remote attackers to execute arbitrary code via a TiVo TY
media file with a header containing a crafted size value.
======================================================
Name: CVE-2008-4686
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4686
Reference: MLIST:[oss-security] 20081019 CVE id request: vlc
Reference: URL:http://www.openwall.com/lists/oss-security/2008/10/19/2
Reference: CONFIRM:http://git.videolan.org/?p=vlc.git;a=commitdiff;h=d859e6b9537af2d7326276f70de25a840f554dc3
Multiple integer overflows in ty.c in the TY demux plugin (aka the
TiVo demuxer) in VideoLAN VLC media player, probably 0.9.4, allow
remote attackers to have an unknown impact via a crafted .ty file, a
different vulnerability than CVE-2008-4654.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
