Arch Linux Security Advisory ASA-201706-1 ========================================= Severity: High Date : 2017-06-01 CVE-ID : CVE-2017-8310 CVE-2017-8311 CVE-2017-8312 Package : vlc Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-283 Summary ======= The package vlc before version 2.2.6-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.2.6-1. # pacman -Syu "vlc>=2.2.6-1" The problems have been fixed upstream in version 2.2.6. Workaround ========== None. Description =========== - CVE-2017-8310 (denial of service) Heap out-of-bound read in CreateHtmlSubtitle in VideoLAN VLC 2.2.x due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process (causing a denial of service) via a crafted subtitles file. - CVE-2017-8311 (arbitrary code execution) Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file. - CVE-2017-8312 (denial of service) Heap out-of-bound read in ParseJSS in VideoLAN VLC due to missing check of string length allows attackers to read heap uninitialized data via a crafted subtitles file. Impact ====== A local attacker is able to use a specially crafted subtitles file to crash the application or execute arbitrary code on the affected host. References ========== https://bugs.archlinux.org/task/54194 http://git.videolan.org/?p=vlc/vlc-2.2.git;a=commitdiff;h=7cac839692ab79dbfe... http://git.videolan.org/?p=vlc.git;a=commitdiff;h=775de716add17322f24b476439... http://git.videolan.org/?p=vlc.git;a=commitdiff;h=611398fc8d32f3fe4331f60b22... https://security.archlinux.org/CVE-2017-8310 https://security.archlinux.org/CVE-2017-8311 https://security.archlinux.org/CVE-2017-8312