oss-sec mailing list archives
Re: CVE request: VLC media player - DLL preloading vulnerability
From: Geoffroy Couprie <geal () videolan org>
Date: Thu, 26 Aug 2010 09:58:24 +0200
On Thu, Aug 26, 2010 at 1:56 AM, Steven M. Christey <coley () linus mitre org> wrote:
We will have one CVE per vulnerable application. Yes, it's going to be very painful. Roughly, the rationale is: "the product does not protect against a common configuration/behavior in its environment."VLC was exploitable by loading wintab32.dll, a component request by Qt, as shown in http://www.exploit-db.com/exploits/14750/Use CVE-2010-3124
Thank you.
There's another possibility with DMO.Is this a distinct product outside of VLC, or is it just a different component / attack vector?
DMO stands for DirectX media objects. These are the codecs and video filters used in DirectShow. So, potentially, all the applications using external codecs or filters are vulnerable. And the issue with wintab32.dll is caused by Qt, so developers using Qt should check their applications. Best regards, -- Geoffroy Couprie http://unhandledexpression.com
Current thread:
- CVE request: VLC media player - DLL preloading vulnerability Geoffroy Couprie (Aug 25)
- Re: CVE request: VLC media player - DLL preloading vulnerability Steven M. Christey (Aug 25)
- Re: CVE request: VLC media player - DLL preloading vulnerability Geoffroy Couprie (Aug 26)
- Re: CVE request: VLC media player - DLL preloading vulnerability Steven M. Christey (Aug 25)