<vlc-2.0.2: Ogg Heap buffer overflow & CVE-2012-2396

[Karma Dorje]

It includes the following security content:

Fixed Ogg Heap buffer overflow
ogg: Fix a heap buffer overflow.
Reported by: An anonymous contributor working with the SecuriTeam Secure
Disclosure
program (http://www.beyondsecurity.com/ssd.html)
(cherry picked from commit 6a41b030f5b7fcbe5ad7249c374172c0fdc29add)
http://git.videolan.org/gitweb.cgi/vlc/vlc-2.0.git/?a=commit;h=16e9e126333fb7acb47d363366fee3deadc8331e

Updated taglib (CVE-2012-2396)

[Aballier (aballier)]

Not much more information besides vlc-2.0.2 NEWS file:
Security:
 * Fix Ogg Heap buffer overflow

and this commit:
http://git.videolan.org/gitweb.cgi/vlc/vlc-2.0.git/?a=commit;h=16e9e126333fb7acb47d363366fee3deadc8331e

2.0.2 should be safe to stabilise though.

[J-ago (j-ago)]

ok to proceed with stabilization?

[Micah Gersten (micahg)]

2.0.2 is in quantal

[Glsamaker (glsamaker)]

CVE-2012-3377 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3377):
  Heap-based buffer overflow in the Ogg_DecodePacket function in the OGG
  demuxer (modules/demux/ogg.c) in VideoLAN VLC media player before 2.0.2
  allows remote attackers to cause a denial of service (application crash) and
  possibly execute arbitrary code via a crafted OGG file.