VLC media player improperly handles format strings, allowing for the execution of arbitrary code.
|Package||media-video/vlc on all architectures|
|Affected versions||< 0.8.6-r1|
|Unaffected versions||>= 0.8.6-r1|
VLC media player is a multimedia player for various audio and video formats.
Kevin Finisterre has discovered that when handling media locations, various functions throughout VLC media player make improper use of format strings.
An attacker could entice a user to open a specially crafted media location or M3U file with VLC media player, and execute arbitrary code on the system with the rights of the user running VLC media player.
There is no known workaround at this time.
All VLC media player users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-video/vlc-0.8.6-r1"
January 26, 2007
January 26, 2007: 01