VLC media player: Format string vulnerability

VLC media player: Format string vulnerability VLC media player improperly handles format strings, allowing for the execution of arbitrary code. vlc 2007-01-26 2007-01-26 159845 remote 0.8.6-r1 0.8.6-r1

VLC media player is a multimedia player for various audio and video formats.

Kevin Finisterre has discovered that when handling media locations, various functions throughout VLC media player make improper use of format strings.

An attacker could entice a user to open a specially crafted media location or M3U file with VLC media player, and execute arbitrary code on the system with the rights of the user running VLC media player.

There is no known workaround at this time.

All VLC media player users should upgrade to the latest version:


    # emerge --sync
    # emerge --ask --oneshot --verbose ">=media-video/vlc-0.8.6-r1"

CVE-2007-0017 falco falco shellsage