Bug 36952
| Summary: | vlc: Multiple issues (4.0) | ||
|---|---|---|---|
| Product: | UCS | Reporter: | Moritz Muehlenhoff <jmm> |
| Component: | Security updates | Assignee: | Daniel Tröder <troeder> |
| Status: | CLOSED FIXED | QA Contact: | Stefan Gohmann <gohmann> |
| Severity: | normal | ||
| Priority: | P3 | CC: | gohmann, requate, walkenhorst |
| Version: | UCS 4.0 | Flags: | requate:
Patch_Available+
|
| Target Milestone: | UCS 4.0-3-errata | ||
| Hardware: | Other | ||
| OS: | Linux | ||
| What kind of report is it?: | --- | What type of bug is this?: | --- |
| Who will be affected by this bug?: | --- | How will those affected feel about the bug?: | --- |
| User Pain: | Enterprise Customer affected?: | ||
| School Customer affected?: | ISV affected?: | ||
| Waiting Support: | Flags outvoted (downgraded) after PO Review: | ||
| Ticket number: | Bug group (optional): | ||
| Max CVSS v3 score: | |||
| Bug Depends on: | |||
| Bug Blocks: | 39300 | ||
|
Description
Moritz Muehlenhoff
Buffer overflow in MP4 demuxer (CVE-2014-9626, CVE-2014-9627, CVE-2014-9628) Buffer overflow in the Dirac encoder (CVE-2014-9629) Buffer overflow in RTP streaming (CVE-2014-9630) Buffer overflow in SDP parsing (CVE-2015-1202) Buffer overflow in the FTP handler (CVE-2015-1203) Fixed in upstream Debian package version 2.0.3-5+deb7u2 Marked as "non-issues": CVE-2015-1202 CVE-2015-1203 ( https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775866#45 ) vlc 2.0.3-5+deb7u2 was imported and build to scope errata4.0-3. YAML (r63409): 2015-09-02-vlc.yaml CVE-2015-1202 and CVE-2015-1203 are disputed by mitre. Package is still vulnerable against CVE-2013-6283 (→ Bug #39300) Test installation / upgrade: OK
YAML: Failed:
Can you re-check the YAML file with the Debian changelog /usr/share/doc/vlc-data/changelog.Debian.gz:
vlc (2.0.3-5+deb7u2) wheezy-security; urgency=high
* Fix multiple vulnerabilities (Closes: #775866):
- Fix potential buffer overflow in the Dirac and Schroedinger encoders
as per CVE-2014-9629
- Fix buffer overflow when parsing string boxes in the MP4 demuxer
as per CVE-2014-9626, CVE-2014-9627, CVE-2014-9628
- Fix possible invalid memory access in the RTP code as per CVE-2014-9630
YAML fixed in commit 63514. (In reply to Daniel Tröder from comment #5) > YAML fixed in commit 63514. OK |