VLC media player is prone to multiple stack-based buffer-overflow vulnerabilities. When parsing a MP4, ASF or AVI file with an overly deep box structure, a stack overflow might occur. It would overwrite the return address and thus redirect the execution flow. Attackers can exploit these issues to execute arbitrary code in the context of the affected application or crash the application, denying service to legitimate users. VLC media player 1.0.1 is vulnerable; prior versions may also be affected.
Thursday, November 5, 2009 - 18:00