MGASA-2015-0053
Vulnerability Summary
Timeline
Description
Updated vlc packages fix security vulnerabilities Updated vlc packages fix security vulnerabilities: On 32 bit builds, parsing of update status files with a size of 4294967295 or more lead to an integer truncation caused by a cast to size_t in a call to malloc and a subsequent buffer overflow. This happened prior to checking the files' signature (CVE-2014-9625). The MP4 demuxer, when parsing string boxes, did not properly check the length of the box, leading to a possible integer underflow when using this length value in a call to memcpy(). This could allow remote attackers to cause a denial of service (crash) or arbitrary code execution via crafted MP4 files (CVE-2014-9626). The MP4 demuxer, when parsing string boxes, did not properly check that the conversion of the box length from 64bit integer to 32bit integer on 32bit platforms did not cause a truncation, leading to a possible buffer overflow. This could allow remote attackers to cause a denial of service (crash) or arbitrary code execution via crafted MP4 files (CVE-2014-9627). The MP4 demuxer, when parsing string boxes, did not properly check the length of the box, leading to a possible buffer overflow. This could allow remote attackers to cause a denial of service (crash) or arbitrary code execution via crafted MP4 files (CVE-2014-9628). The Dirac and Schroedinger encoders did not properly check for an integer overflow on 32bit platforms, leading to a possible buffer overflow. This could allow remote attackers to cause a denial of service (crash) or arbitrary code execution (CVE-2014-9629). When streaming ogg-files via rtp, an ogg-file can trigger an invalid memory write access using an overly long 'configuration' string, which causes an attempted stack allocation with an attacker-controlled size (CVE-2014-9630).
Affected Systems
- mageia•vlc
< 2.1.5-1.1.mga4 | < 2.1.5-1.1.mga4.tainted