| Description: | | A buffer overflow vulnerability has been reported in VideoLAN VLC Media Player. The vulnerability is due to a boundary error in function "Win32AddConnection()" in file "modules/access/smb.c" while parsing specially crafted SMB path. Remote attackers can exploit this vulnerability, for example, by enticing target users to open a playlist file having an overly long "smb://" URI that will cause an stack buffer overflow, or by sending a specially crafted request to VLC web interface. In an attack case where code injection is successful, the behaviour of the target is entirely dependent on the intended function of the injected code. The code in such a case would execute within the security context of the logged in user. In an attack case where code injection is not successful, the affected application will terminate abnormally. |