Bug 49658

Summary: vlc: Multiple issues (4.4)
Product: UCS Reporter: Quality Assurance <qa>
Component: Security updatesAssignee: Quality Assurance <qa>
Status: CLOSED FIXED QA Contact: Philipp Hahn <hahn>
Severity: normal    
Priority: P3    
Version: UCS 4.4   
Target Milestone: UCS 4.4-0-errata   
Hardware: All   
OS: Linux   
What kind of report is it?: Security Issue What type of bug is this?: ---
Who will be affected by this bug?: --- How will those affected feel about the bug?: ---
User Pain: Enterprise Customer affected?:
School Customer affected?: ISV affected?:
Waiting Support: Flags outvoted (downgraded) after PO Review:
Ticket number: Bug group (optional):
Max CVSS v3 score: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) NVD

Description Quality Assurance univentionstaff 2019-06-16 14:23:37 CEST
New Debian vlc 3.0.7-0+deb9u1 fixes:
This update addresses the following issue:

* 3.0.7-0+deb9u1 (Sun, 09 Jun 2019 22:00:27 +0200) * New upstream bug fix  release. - Fix multiple integer overflows. - Fix multiple buffer overflows.  - Fix use-after-free issue. - Fix NULL pointer dereference. - Fix other  memory access bugs and infinite loops. * debian/patches: Removed, included  upstream.

* 3.0.7-0+deb9u1 (Sun, 09 Jun 2019 22:00:27 +0200) * New upstream bug fix  release. - Fix multiple integer overflows. - Fix multiple buffer overflows.  - Fix use-after-free issue. - Fix NULL pointer dereference. - Fix other  memory access bugs and infinite loops. * debian/patches: Removed, included  upstream.

* 3.0.7-0+deb9u1 (Sun, 09 Jun 2019 22:00:27 +0200) * New upstream bug fix  release. - Fix multiple integer overflows. - Fix multiple buffer overflows.  - Fix use-after-free issue. - Fix NULL pointer dereference. - Fix other  memory access bugs and infinite loops. * debian/patches: Removed, included  upstream.
* vlc (CVE-2019-5439)
Comment 1 Quality Assurance univentionstaff 2019-06-16 15:30:29 CEST
--- mirror/ftp/4.4/unmaintained/4.4-0/source/vlc_3.0.6-0+deb9u1.dsc
+++ apt/ucs_4.4-0-errata4.4-0/source/vlc_3.0.7-0+deb9u1.dsc
@@ -1,3 +1,13 @@
+3.0.7-0+deb9u1 [Sun, 09 Jun 2019 22:00:27 +0200] Sebastian Ramacher <sramacher@debian.org>:
+
+  * New upstream bug fix release. (Closes: #930276)
+    - Fix multiple integer overflows.
+    - Fix multiple buffer overflows.
+    - Fix use-after-free issue.
+    - Fix NULL pointer dereference.
+    - Fix other memory access bugs and infinite loops.
+  * debian/patches: Removed, included upstream.
+
 3.0.6-0+deb9u1 [Thu, 10 Jan 2019 21:42:19 +0100] Sebastian Ramacher <sramacher@debian.org>:
 
   * New upstream bug fix release.

<http://10.200.17.11/4.4-0/#2670221641719330705>
Comment 2 Philipp Hahn univentionstaff 2019-06-17 13:02:52 CEST
OK: yaml
OK: announce_errata
OK: patch
OK: piuparts

[4.4-0] 5e31efc214 Bug #49658: vlc 3.0.7-0+deb9u1
 doc/errata/staging/vlc.yaml | 21 ++-------------------
 1 file changed, 2 insertions(+), 19 deletions(-)

[4.4-0] 37047a906c Bug #49658: vlc 3.0.7-0+deb9u1
 doc/errata/staging/vlc.yaml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
Comment 3 Arvid Requate univentionstaff 2019-06-19 15:52:45 CEST
<http://errata.software-univention.de/ucs/4.4/151.html>