URL format string injection in CDDA and VCDX plugins

[Xtophe]

Binary package hint: vlc

This is a security problem.
VLC media player CDDA (CD Digital Audio) and VCDX (Video CD) plugins are prone to a C-style format string vulnerability when trying to open a media resource location. The bug occurs when handling error and debug messages from underlying library libcdio.

Because the VCDX plugins probes every media resource location unless another plugin successfully opened the resource, almost any invalid location can trigger the bug.

See http://www.videolan.org/sa0701.html for further information and patch.
It is referenced under CVE-2007-0017, VideoLAN-SA-0701, MOAB-02-01-2007

[Xtophe (xtophe)]

I forgot to say it affects VLC version 0.7.0 to O.8.6. So all version in Ubuntu are concerned.

[Daniel T Chen (crimsun)]

Sit tight, I'm on this.

[Kees Cook (kees)]

Edgy has been published, it should be visible in the archives shortly.

[Matti Lindell (mlind)]

Hopefully the hole is plugged soon in feisty too, crimsun any news?

[Matti Lindell (mlind)]

 vlc (0.8.6.release-0ubuntu2) feisty; urgency=low
 .
   * debian/control:
     - Adhere to DebianMaintainerField,
     - Build against libwxgtk2.8-dev, Closes:
       LP: #54548
       LP: #84098
   * debian/patches: Add 030_CVE-2007-0017.diff to quilt's series
     - Reference: CVE-2007-0017

[Marco Rodrigues (gothicx)]

Breezy support is over.. Today it's Breezy End Of Life!

[William Grant (wgrant)]

Seems that the Dapper update got caught in a queue somewhere:

--
vlc (0.8.4.debian-1ubuntu6.1) dapper-security; urgency=low

  * Fix format string vulnerability with patch taken from Debian BTS
    MOAB-02-01-2007-CVE-2007-0017.dpatch, CVE-2007-0017. Closes Malone: #78610

 -- Martin Juergens <email address hidden> Sat, 27 Jan 2007 18:39:58 +0100