Univention Bugzilla – Bug 36952
vlc: Multiple issues (4.0)
Last modified: 2017-10-26 13:54:45 CEST
Buffer overflow in processing RTSP streams (CVE-2013-6933)
Buffer overflow in MP4 demuxer (CVE-2014-9626, CVE-2014-9627, CVE-2014-9628) Buffer overflow in the Dirac encoder (CVE-2014-9629) Buffer overflow in RTP streaming (CVE-2014-9630) Buffer overflow in SDP parsing (CVE-2015-1202) Buffer overflow in the FTP handler (CVE-2015-1203)
Fixed in upstream Debian package version 2.0.3-5+deb7u2 Marked as "non-issues": CVE-2015-1202 CVE-2015-1203 ( https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775866#45 )
vlc 2.0.3-5+deb7u2 was imported and build to scope errata4.0-3. YAML (r63409): 2015-09-02-vlc.yaml CVE-2015-1202 and CVE-2015-1203 are disputed by mitre. Package is still vulnerable against CVE-2013-6283 (→ Bug #39300)
Test installation / upgrade: OK YAML: Failed: Can you re-check the YAML file with the Debian changelog /usr/share/doc/vlc-data/changelog.Debian.gz: vlc (2.0.3-5+deb7u2) wheezy-security; urgency=high * Fix multiple vulnerabilities (Closes: #775866): - Fix potential buffer overflow in the Dirac and Schroedinger encoders as per CVE-2014-9629 - Fix buffer overflow when parsing string boxes in the MP4 demuxer as per CVE-2014-9626, CVE-2014-9627, CVE-2014-9628 - Fix possible invalid memory access in the RTP code as per CVE-2014-9630
YAML fixed in commit 63514.
(In reply to Daniel Tröder from comment #5) > YAML fixed in commit 63514. OK
<http://errata.software-univention.de/ucs/4.0/311.html>