Bug 36952 - vlc: Multiple issues (4.0)
vlc: Multiple issues (4.0)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.0
Other Linux
: P3 normal (vote)
: UCS 4.0-3-errata
Assigned To: Daniel Tröder
Stefan Gohmann
:
Depends on:
Blocks: 39300
  Show dependency treegraph
 
Reported: 2014-11-24 10:09 CET by Moritz Muehlenhoff
Modified: 2017-10-26 13:54 CEST (History)
3 users (show)

See Also:
What kind of report is it?: ---
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:
requate: Patch_Available+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Moritz Muehlenhoff univentionstaff 2014-11-24 10:09:29 CET
Buffer overflow in processing RTSP streams (CVE-2013-6933)
Comment 1 Moritz Muehlenhoff univentionstaff 2015-01-21 09:36:14 CET
Buffer overflow in MP4 demuxer (CVE-2014-9626, CVE-2014-9627, CVE-2014-9628)
Buffer overflow in the Dirac encoder (CVE-2014-9629)
Buffer overflow in RTP streaming (CVE-2014-9630)
Buffer overflow in SDP parsing (CVE-2015-1202)
Buffer overflow in the FTP handler (CVE-2015-1203)
Comment 2 Arvid Requate univentionstaff 2015-05-07 16:52:33 CEST
Fixed in upstream Debian package version 2.0.3-5+deb7u2


Marked as "non-issues": CVE-2015-1202 CVE-2015-1203
( https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775866#45 )
Comment 3 Daniel Tröder univentionstaff 2015-09-02 17:28:11 CEST
vlc 2.0.3-5+deb7u2 was imported and build to scope errata4.0-3.
YAML (r63409): 2015-09-02-vlc.yaml

CVE-2015-1202 and CVE-2015-1203 are disputed by mitre.

Package is still vulnerable against CVE-2013-6283 (→ Bug #39300)
Comment 4 Stefan Gohmann univentionstaff 2015-09-08 08:27:13 CEST
Test installation / upgrade: OK

YAML: Failed:

Can you re-check the YAML file with the Debian changelog /usr/share/doc/vlc-data/changelog.Debian.gz:

vlc (2.0.3-5+deb7u2) wheezy-security; urgency=high

  * Fix multiple vulnerabilities (Closes: #775866):
    - Fix potential buffer overflow in the Dirac and Schroedinger encoders
      as per CVE-2014-9629
    - Fix buffer overflow when parsing string boxes in the MP4 demuxer
      as per CVE-2014-9626, CVE-2014-9627, CVE-2014-9628
    - Fix possible invalid memory access in the RTP code as per CVE-2014-9630
Comment 5 Daniel Tröder univentionstaff 2015-09-08 14:30:35 CEST
YAML fixed in commit 63514.
Comment 6 Stefan Gohmann univentionstaff 2015-09-08 15:37:10 CEST
(In reply to Daniel Tröder from comment #5)
> YAML fixed in commit 63514.

OK
Comment 7 Janek Walkenhorst univentionstaff 2015-09-09 12:52:36 CEST
<http://errata.software-univention.de/ucs/4.0/311.html>