# MA-266.022011: MyCERT Alert - Critical Vulnerability in VideoLAN Client (VLC) Media Player

**Date:** 02 Feb 2011  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-266.022011  
**Advisory ID:** MA-266.022011

---

**1.0 Introduction**
A critical vulnerability (CVE-2011-0531) has been identified in VideoLAN Client (VLC) Media Player version 1.1.6.1 and below. The vulnerability exists when parsing an invalid MKV (Matroska or WebM) file due to insufficient input validation. [1]
MyCERT is aware that exploits are available in the wild at the time of the publication of this advisory.
**2.0 Impact**
An attacker who successfully exploits this vulnerability will be able to execute codes remotely and gain the same privilege as the user. Unsuccessful attacks may cause denial-of-service (DoS) outcomes.
**3.0 Affected Products**
- VLC media player 1.1.6.1 and earlier
**4.0 Recommendations**
> 4.1 Update to the latest version of VLC Media Player (1.1.7)
>
> 4.2 Users who unable to perform the update are recommended to refrain from opening files from untrusted third parties or accessing untrusted remote sites (or disable the VLC browser plugins), until the patch is applied.
MyCERT would like to advise the users to be vigilant of the latest security announcements by the vendors and ensure that their applications are updated.
Users may also consider using a vulnerability management tool such as Secunia to ensure that all applications are updated:
- <http://secunia.com/vulnerability_scanning/personal/>
MyCERT can be reached through the following channels for further assistance:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#0c61756f697e784c61756f697e7822637e6b226175)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT <EMAIL> <COMPLAINT> to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
- <http://www.videolan.org/security/sa1102.html>
- <http://www.openwall.com/lists/oss-security/2011/01/19/6>
- [http://git.videolan.org](http://git.videolan.org/?p=vlc.git&a=commitdiff&h=59491dcedffbf97612d2c572943b56ee4289dd07&hp=f085cfc1c95b922e3c750ee93ec58c3f2d5f7456)