vlc -- format string vulnerability and integer overflow

isecpartners reports:

VLC is vulnerable to a format string attack in the parsing
of Vorbis comments in Ogg Vorbis and Ogg Theora files, CDDA
data or SAP/SDP service discovery messages. Additionally,
there are two errors in the handling of wav files, one a
denial of service due to an uninitialized variable, and one
integer overflow in sampling frequency calculations.