Torrentfreak are reporting that two vulnerabilities have been discovered in VLC Player which allow execution of arbitrary code. The second vulnerability has already been fixed in the newest version of VLC which is available for download on the developers homepage. The first vulnerability however can be exploited to cause stack-based buffer overflows when loading subtitles in VLC.
The solution given by the security company that discovered the vulnerability is to load only subtitles from trusted source or no subtitles at all until an official fix has been posted by the developers ov VLC.
Another option would be to switch to another player for the time being. SMPlayer, my favorite player, is another good choice which does not have this vulnerability.
Related posts:
Real Player Internet Explorer vulnerabilityGoogle Chrome Address Spoofing Vulnerability
A VLC alternative called SMPlayer
Adobe Reader, Acrobat and Flash Player Zero Day Vulnerability
Adobe Flash Player Clickjacking Vulnerability
SMPlayer Portable
SMPlayer 0.6.7 out
Google Chrome Security Vulnerability
Is there yet a way to avoid the “Pause”-lag?
Also try MPC, I use 3 players VLC, SMplayer and MPC. Not every Player can actually play .avi files.