<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">FYI, Yesterday I learned about a serious buffer-overflow bug in the LIVE555 library that affects VLC, and all other RTSP client applications that use the LIVE555 library. This bug could potentially allow an attacker (with a malicious RTSP server) to cause cause arbitrary code to be executed in VLC.<div><br></div><div>This bug has now been fixed in the latest version (2013.11.26) of the LIVE555 library - tarball available at:</div><div><span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://www.live555.com/liveMedia/public/">http://www.live555.com/liveMedia/public/</a></div><div>VLC distributions that use the LIVE555 library should upgrade to use this new version.</div><br><div apple-content-edited="true"><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px;">Ross Finlayson<br>Live Networks, Inc.<br><a href="http://www.live555.com/">http://www.live555.com/</a></span></div><div apple-content-edited="true"><br></div></body></html>