Stuff like sophisticated government spyware is scary and all – but don't forget, a single .wmv file can pwn you via VLC

VideoLAN has issued an update to address a baker's dozen of CVE-listed security vulnerabilities in its widely used VLC player software. The VLC update includes patches to clear up flaws that range in impact from denial of service (read: application crashes) to remote code execution (i.e. malware installation). Users and admins …

[Lee D]

"This vulnerability could be triggered by inserting specially crafted headers which are not correctly counted by the xiph_CountHeadersfunction. As a result, the total number of bytes that could be written is larger than expected, overflowing previously allocated buffers," Semmle notes in its disclosure.

"As a result, the total number of bytes that could be written is larger than expected, overflowing previously allocated buffers. In this case, the vulnerability risk is also increased due to the large amount of bytes that can be overwritten, and the possibility that it can also be turned into an OOB read."

It's worse than we thought! I think that quote overflowed into the next paragraph!

[STOP_FORTH]

Glitch in The Matrix!

[SVV]

I think that quote overflowed into the next paragraph! It's happening in the comments too!

[A Non e-mouse]

Obligatory XKCD

xkcd.com/538/

[Anonymous Coward]

Re: Obligatory XKCD

Obligatory or completely off-topic?

If the suggestion is that VLC would never be used as a vector to get malware onto a users device, then I guess we just have different expectations of the trust levels involved in the origin of content that users might play in VLC.

[Stuart Halliday]

Overflow problems in this day and age?

We've known about these issues for decades. Why are programmers still doing this?

[Anonymous Coward]

_{We've known about these issues for decades. Why are programmers still doing this?}

Learn C and then come back. In the mean time, wind it in.

[Luke McCarthy]

Lots of old C and C++ code, especially in video codec, that is difficult to write and re-write. Who is going to re-write hundreds of legacy codecs in Rust? And who is going to pay them to do it? (Nobody)

[Paul Crawford]

Also they should be using sandboxing stuff (like an Apparmor profile that is on by default) so when the inevitable bugs come along their ability to play havoc with your system are greatly reduced.

[e^iπ+1=0]

Cross platform?

Or?

[phuzz]

Re: Cross platform?

Single platform, obv.

[Anonymous Coward]

a specially-crafted .MP4 file

I have noticed a large uptick in the use of .MP4 for advertising and also for browser fingerprinting.

Kill it with fire I say.

(Sent from my Pi Hole VM)

[Anonymous Coward]

Re: a specially-crafted .MP4 file

(Sent from my Pi Hole VM)

Because using your Pi Hole to browse the web from is really sensible

[Anonymous Coward]

vlc, like web browsers, should run as a nobody user with no access to the local filesystem, and have any files they want to play streamed through a socket to them.

[Potemkine!]

Did we really need another reason to avoid wmv files?