Bug#529633: mozilla-plugin-vlc: Logging through Javascript hurts privacy

[Remi Denis-Courmont]

Package: mozilla-plugin-vlc
Version: 0.9.9a-2
Severity: important
Tags: security


	Hello,

The logging Javascript API (vlc.log.*) provided by this plugin can leak
sensitive informations to third party websites. For instance, one can
enumerate the content of file system by "opening" a directory and then
watching for playlist item messages.

Please remove this mis-feature.

-- System Information:
Debian Release: squeeze/sid
  APT prefers unstable
  APT policy: (100, 'unstable')
Architecture: i386 (i686)

Kernel: Linux 2.6.29.3 (SMP w/2 CPU cores)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages mozilla-plugin-vlc depends on:
ii  libc6                         2.9-12     GNU C Library: Shared libraries
ii  libgcc1                       1:4.4.0-5  GCC support library
ii  libstdc++6                    4.4.0-5    The GNU Standard C++ Library v3
ii  libvlc2                       0.9.9a-2   multimedia player and streamer lib
ii  libx11-6                      2:1.2.1-1  X11 client-side library
ii  libxpm4                       1:3.5.7-1  X11 pixmap library
ii  libxt6                        1:1.0.5-3  X11 toolkit intrinsics library
ii  vlc                           0.9.9a-2   multimedia player and streamer
ii  vlc-nox                       0.9.9a-2   multimedia player and streamer (wi

mozilla-plugin-vlc recommends no packages.

mozilla-plugin-vlc suggests no packages.