Fabian Wahle

A heap buffer over-read exists in the `xmlparse.c` file. The `XML ParseBuffer()` function advances the parse buffer end using a caller-supplied length that is not validated against the allocated buffer size. Repeated calls to `XML ParseBuffer()` can move the `m bufferEnd` variable past the end of the heap allocation, causing subsequent parsing to read out of bounds. This path is reachable if a parse buffer is already present, which occurs after a call to `XML GetBuffer()` or an internal allocation via `XML Parse()`. This issue allows the disclosure of adjacent heap memory, which can leak heap pointers, libc function pointers, and code pointers, potentially defeating Address Space Layout Randomization (ASLR), a security technique that randomly arranges the address space positions of key data areas of a process to make exploitation harder.

A use-after-free issue exists in the `pyexpat` module's `ExternalEntityParserCreate()` function. This occurs when applications create external-entity sub-parsers without maintaining a reference to the parent parser. The child parser keeps a raw C back-pointer to the parent parser struct, but the tracing garbage collector may free the parent's C struct. Consequently, the bundled libexpat dereferences this freed pointer during token parsing, leading to memory corruption via a specially crafted XML document.

A path traversal issue exists in the skins2 ThemeLoader due to insufficient validation of member names within .vlt skin archives. This allows an attacker to use path traversal sequences in malicious skin files to write arbitrary files with the privileges of the VLC user, which can lead to code execution via Lua script injection.

A memory-safety issue exists when processing crafted media, caused by an integer overflow. An integer overflow occurs when an arithmetic operation attempts to create a numeric value that is too large to be stored in the allotted memory space. Exploitation requires user interaction and may lead to application termination or arbitrary code execution with the privileges of the VLC process.

A memory-safety issue exists when processing media from an attacker-controlled network source. This flaw involves an out-of-bounds read, which may allow a remote attacker to disclose a limited amount of process memory. The extent of the exposure depends on the build configuration and requires user interaction to be exploited.

A denial of service issue exists due to quadratic algorithmic complexity within the `storeAtts()` function in xmlparse.c. When processing N specified attributes with non-normalized values, the system triggers an O(N^2) linear scan of `elementType->defaultAtts` to determine CDATA status. A remote unauthenticated attacker can cause excessive CPU consumption by providing a single well-formed XML document of a few megabytes to an application parsing untrusted XML.