Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 29 Oct 2012 14:27:20 -0400
From: Sean Amoss <>
To:, "Steven M. Christey" <>
 Gentoo Linux Security Team <>,
Subject: VideoLAN TiVo Demuxer Duplicate CVEs (CVE-2011-5231 and CVE-2012-0023)

Steve, MITRE, vendors:

It appears that there may be two CVE's for the same issue:

CVE-2011-5231 - Double free vulnerability in the get_chunk_header
function in modules/demux/ty.c in VideoLAN VLC media player 0.9.0
through 1.1.12 allows remote attackers to cause a denial of service
(crash) and possibly execute arbitrary code via a crafted TiVo (TY) file.

References to


CVE-2012-0023 - Buffer overflow in VLC TiVo demuxer

CVE Assignment:

References in assignment above

Sean Amoss
Gentoo Security | GLSA Coordinator
E-Mail	  :
GnuPG FP  : E58A AABD DD2D 03AF 0A7A 2F14 1877 72EC E928 357A

Download attachment "signature.asc" of type "application/pgp-signature" (295 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.