Buffer overflow in VUPlayer 2.49 and earlier allows user-assisted attackers to execute arbitrary code via a long URL in a File line in a .pls file, as demonstrated by an http URL on a File1 line.

More... (http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0182)