Ubuntu
vlc package

Multiple vulnerabilites in vlc prior to 0.8.6e

Bug #196452 reported by Mathieu Marquer
274
Affects Status Importance Assigned to Milestone
vlc (Debian)
Fix Released
Unknown
vlc (Ubuntu)
Fix Released
Undecided
William Grant
Dapper
Won't Fix
Undecided
Unassigned
Edgy
Won't Fix
Undecided
Unassigned
Feisty
Won't Fix
Undecided
Unassigned
Gutsy
Won't Fix
Undecided
Unassigned
Hardy
Fix Released
Undecided
William Grant

Bug Description

Binary package hint: vlc

A few days ago, vlc 0.8.6e has been released. The developpers "strongly recommend all users to update to this new version" since it fixes security vulnerabilities. Please update vlc to vlc 0.8.6e in all Ubuntu versions that are still supported.

Here is the annoucement :

VLC media player 0.8.6e, VideoLAN Security 0801 and 0802 (2008-02-27)

This is a bugfix release. VLC media player 0.8.6d and earlier versions suffer from security vulnerabilities in the Web interface, Subtitle demuxer, Real RTSP demuxer, SDL_image library and MP4 demuxer.
Technical details are available in our advisories: SA-0801 and SA-0802.
The usual collection of assorted changes and improvements can be found here.
This release fully supports Mac OS X 10.3.9 once again.
We strongly recommend all users to update to this new version.

and the release notes :

Changes between 0.8.6d and 0.8.6e:
----------------------------------

Various bugfixes:
 * Resume playback for viewing content over FTP
 * Fixed XShm detection with remote X11

Security updates:
 * Subtitle demuxers overflow (CVE-2007-6681)
 * HTTP listener format string injection (CVE-2007-6682)
 * Fixed buffer overflow in the SDL_image library (CVE-2006-4484)
 * Real RTSP overflows (CVE-2008-0225, CVE-2008-0295, CVE-2008-0296, VideoLAN-SA-0801)
 * Arbitrary memory overwrite in the MP4 demuxer (CORE-2008-0130, VideoLAN-SA-0802)

Audio filter:
 * Fixed DTS to S/PDIF converter

Audio output:
 * Fixed 5.1 audio on ALSA

Access:
 * Fixed some RTSP hanging and user/password passing through RTSP URLs

Stream output:
 * Fixed waiting for SPS/PPS problem in H.264 packetizer

Encoders:
 * Improved compatibility for creating H.264 video files playable on iPhones
 * Improved detection of optimal amount of threads for multi-threaded H.264 encoding on multi-cpu systems
    - Note that this is used when transcode threads is set to 0 (default)
    - Not supported on Windows (multiple threads require manual configuration)

Mac OS X Interface & Port:
 * Restored compatibility with Mac OS X 10.3.9
 * Corrected behavior of the Preferences panel
 * VLC no longer crashes on quit while playing

Localization:
 * Updated Romanian and Polish translations

Tags: security
Revision history for this message
Adna rim (adnarim) wrote :

Confirmed all versions dapper-hardy affected.

greets

Changed in vlc:
status: New → Confirmed
Revision history for this message
Serge (serge-de-souza) wrote :

Have the CVEs listed here been patched in the latest release?

Revision history for this message
Mathieu Marquer (slasher-fun) wrote :

Yes, as you can see in the release notes.

Revision history for this message
Serge (serge-de-souza) wrote :

Can we then have the fixes in Ubuntu? By latest release, I was referring to Ubuntu releases but I did not make that clear.

Bug Watch Updater (bug-watch-updater)
Changed in vlc:
status: Unknown → Fix Released
Revision history for this message
Mathieu Marquer (slasher-fun) wrote :

Adding new CVE references since new security holes have been discovered on vlc 0.8.6d and previous (vlc 0.8.6e is 75% fixed on these new security holes)

William Grant (wgrant)
Changed in vlc:
status: New → Confirmed
status: New → Confirmed
William Grant (wgrant)
Changed in vlc:
status: New → Confirmed
Revision history for this message
William Grant (wgrant) wrote :

The diff in 0.8.6e is insane. I doubt it's going to happen for Hardy, but the security fixes should.

Changed in vlc:
status: New → Confirmed
Revision history for this message
William Grant (wgrant) wrote :

The diff for 0.8.6e isn't as insane as I thought; an FFe is currently pending.

Changed in vlc:
assignee: nobody → fujitsu
status: Confirmed → In Progress
Revision history for this message
Matti Lindell (mlind) wrote :

William, if you're doing this, please consider reviewing packaging changes from the Debian since last merge. They've made some very nice cleanups and build process looks more sane again. I think we could even build against our own libfaad-dev as it's in the universe now. Thanks in advance for the much awaited FFe.

Revision history for this message
William Grant (wgrant) wrote : Re: [Bug 196452] Re: Multiple vulnerabilites in vlc prior to 0.8.6e

Matti Lindell wrote:
> William, if you're doing this, please consider reviewing packaging
> changes from the Debian since last merge. They've made some very nice
> cleanups and build process looks more sane again. I think we could even
> build against our own libfaad-dev as it's in the universe now. Thanks in
> advance for the much awaited FFe.

I'd prefer not to do that less than a month before release. Merging with
Debian would be very good, and I'll probably look at it for Intrepid.

--
William Grant

Revision history for this message
William Grant (wgrant) wrote :

CVE-2008-1489 has also appeared, and is tracked in bug #207284.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package vlc - 0.8.6.release.e+x264svn20071224+faad2.6.1-0ubuntu1

---------------
vlc (0.8.6.release.e+x264svn20071224+faad2.6.1-0ubuntu1) hardy; urgency=low

  [ Mario Limonciello ]
  * New upstream version. (LP: #206918)
    - New versioning scheme to bring attention to the fact that
      faad and x264 are in the .orig.tar.gz.
    - Fixes 6 CVEs (LP: #196452)
      + CVE: 2007-6681
      + CVE: 2007-6682
      + CVE: 2007-6683
      + CVE: 2008-0295
      + CVE: 2008-0296
  * Drop 021_CVE-2008-0984 as it's included upstream.
  * debian/rules:
    - Adjust items touched for faad2 when building.
    - Apply all faad2 patches when building
  * debian/control:
    - Add dpatch, libfaad-dev, and autotools-dev to build-depends to allow
      faad2 to build again.
    - Add automake, cvs, and libtool to build depends (now needed for building VLC)

  [ Martin Hamrle ]
   * Add new package with pulse output plugin (LP: #196417)
     - debian/patches/030_pulse.diff:
       + patch from upstream trunk to support pulseaudio output
     - debian/rules:
       + enable pulseaudio
     - debian/control:
       + add dependencies to libpulse-dev
       + new package description
     - Creates a NEW binary package, requiring FFe (LP: #204050)

 -- Mario Limonciello <email address hidden> Tue, 25 Mar 2008 20:08:07 -0500

Changed in vlc:
status: In Progress → Fix Released
Revision history for this message
William Grant (wgrant) wrote :

According to further upstream changelogs, 0.8.6e apparently didn't really fix CVE-2007-668[13]. Upstream is so reliable.

Revision history for this message
Hew (hew) wrote :

Ubuntu Edgy Eft is no longer supported, so a SRU will not be issued for this release. Marking Edgy as Won't Fix.

Changed in vlc:
status: Confirmed → Won't Fix
Revision history for this message
Hew (hew) wrote :

Ubuntu Feisty Fawn is no longer supported, so a SRU will not be issued for this release. Marking Feisty as Won't Fix.

Changed in vlc:
status: Confirmed → Won't Fix
Revision history for this message
Sergio Zanchetta (primes2h) wrote :

The 18 month support period for Gutsy Gibbon 7.10 has reached its end of life -
http://www.ubuntu.com/news/ubuntu-7.10-eol . As a result, we are closing the
Gutsy task.

Changed in vlc (Ubuntu Gutsy):
status: Confirmed → Won't Fix
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Thank you for reporting this bug to Ubuntu. dapper has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against dapper is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.

Changed in vlc (Ubuntu Dapper):
status: Confirmed → Won't Fix
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Duplicates of this bug

Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.