CVE-2008-5276 Information

Description

Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC media player 0.9.0 through 0.9.7 allows remote attackers to execute arbitrary code via a malformed RealMedia (.rm) file that triggers a heap-based buffer overflow.

Reference

http://git.videolan.org/?p=vlc.git;a=commitdiff;h=d19de4e9f2211cbe5bde00726b66c47a424f4e07 http://secunia.com/advisories/32942 http://secunia.com/advisories/33315 http://security.gentoo.org/glsa/glsa-200812-24.xml http://securityreason.com/securityalert/4680 http://www.osvdb.org/50333 http://www.securityfocus.com/archive/1/498768/100/0/threaded http://www.securityfocus.com/bid/32545 http://www.trapkit.de/advisories/TKADV2008-013.txt http://www.videolan.org/security/sa0811.html http://www.vupen.com/english/advisories/2008/3287 https://oval.cisecurity.org/repository/search/definition/oval3Aorg.mitre.oval3Adef3A14793