- VideoLAN team will be on Open Source Experience Paris.
+ VideoLAN team was on Open Source Experience Paris.
(There's no typo, that's exactly 3 years after our last event)
+
+ 
Those bulletins are related to each VLC release and can be made of multiple security issues, internal and external.
++Summary : Multiple vulnerabilities fixed in VLC media player +Date : November 2022 +Affected versions : VLC media player 3.0.17 and earlier +ID : VideoLAN-SB-VLC-3018 ++ +
If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user.
+While these issues in themselves are most likely to just crash the player, we can't exclude that they could be combined to leak user informations or +remotely execute code. ASLR and DEP help reduce the likelyness of code execution, but may be bypassed.
+We have not seen exploits performing code execution through these vulnerability
+Exploitation of those issues requires the user to explicitly open a specially crafted file or stream.
+ +The user should refrain from opening files from untrusted third parties +or accessing untrusted remote sites (or disable the VLC browser plugins), +until the patch is applied. +
+ +VLC media player 3.0.18 addresses the issue. +
+ +The vnc module vulnerability was reported and fixed by 0xMitsurugi from Synacktiv (#27335, CVE-2022-41325)
+ + +
+ 
+ 
+ 
+ 
+ 
+ 
+
+
+ Version 3.0
+
+
+
+ VLC 3.0 playing 8K 48fps 360 video on Android Galaxy S8 from VideoLAN on Vimeo.
+VLC 3.0 playing 8k60 on Windows 10 using i7 GPU from VideoLAN on Vimeo.
+
+
+
+ Version
+
+ 
+
+
+
+ Version - 64bits
+
+ 
+ 
+ 
+ Ask your favorite packager for VLC 3.0!
+For any questions related to this release, please contact us.
+Those bulletins are related to each VLC release and can be made of multiple security issues, internal and external.
++Summary : Multiple vulnerabilities fixed in VLC media player +Date : November 2022 +Affected versions : VLC media player 3.0.17 and earlier +ID : VideoLAN-SB-VLC-3018 ++ +
If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user.
+While these issues in themselves are most likely to just crash the player, we can't exclude that they could be combined to leak user informations or +remotely execute code. ASLR and DEP help reduce the likelyness of code execution, but may be bypassed.
+We have not seen exploits performing code execution through these vulnerability
+Exploitation of those issues requires the user to explicitly open a specially crafted file or stream.
+ +The user should refrain from opening files from untrusted third parties +or accessing untrusted remote sites (or disable the VLC browser plugins), +until the patch is applied. +
+ +VLC media player 3.0.18 addresses the issue. +
+ +The vnc module vulnerability was reported and fixed by 0xMitsurugi from Synacktiv (#27335, CVE-2022-41325)
+ + +
+
+
+
+
+
+
+
+
+ Version 3.0
+
+
+
+ VLC 3.0 playing 8K 48fps 360 video on Android Galaxy S8 from VideoLAN on Vimeo.
+VLC 3.0 playing 8k60 on Windows 10 using i7 GPU from VideoLAN on Vimeo.
+
+
+
+ Version
+
+
+
+
+
+ Version - 64bits
+
+
+
+
+ Ask your favorite packager for VLC 3.0!
+For any questions related to this release, please contact us.
+A denial of service could be triggered with a wrong mp4 file (div by 0) (#27202)
+Fix crashes with multiple files due to double free (#26930)
+A denial of service could be triggered with wrong oog file (null pointer dereference) (#27294)
+Potential buffer overflow in the vnc module could trigger remote code execution if a malicious vnc URL is deliberately played (#27335, CVE-2022-41325)
If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user.
View it on GitLab: https://code.videolan.org/VideoLAN.org/websites/-/commit/df1578901cf4fe9c7719883508c76120dec27f52 -- View it on GitLab: https://code.videolan.org/VideoLAN.org/websites/-/commit/df1578901cf4fe9c7719883508c76120dec27f52 You're receiving this email because of your account on code.videolan.org. VideoLAN code repository instance From gitlab at videolan.org Tue Nov 29 18:13:55 2022 From: gitlab at videolan.org (David (@dfuhrmann)) Date: Tue, 29 Nov 2022 19:13:55 +0100 Subject: [www-doc] [Git][VideoLAN.org/websites][master] stats: Add default entry for 3.0.18 Message-ID: <63864be322efa_43b111c09602564210@gitlab.mail> David pushed to branch master at VideoLAN organization / websites Commits: 98896e22 by David Fuhrmann at 2022-11-29T19:13:47+01:00 stats: Add default entry for 3.0.18 - - - - - 1 changed file: - www.videolan.org/vlc/stats/downloads.php Changes: ===================================== www.videolan.org/vlc/stats/downloads.php ===================================== @@ -215,6 +215,7 @@ "3.0.15" => array( "Windows" => 0, "Macintosh" => 0, "Total" => 0 ), "3.0.16" => array( "Windows" => 0, "Macintosh" => 0, "Total" => 0 ), "3.0.17" => array( "Windows" => 0, "Macintosh" => 0, "Total" => 0 ), + "3.0.18" => array( "Windows" => 0, "Macintosh" => 0, "Total" => 0 ), ); $table = array_merge( $table_old, $table_sf ); View it on GitLab: https://code.videolan.org/VideoLAN.org/websites/-/commit/98896e220bee001a518256b8ba26a7115fe0ae90 -- View it on GitLab: https://code.videolan.org/VideoLAN.org/websites/-/commit/98896e220bee001a518256b8ba26a7115fe0ae90 You're receiving this email because of your account on code.videolan.org. VideoLAN code repository instance From gitlab at videolan.org Tue Nov 29 22:23:21 2022 From: gitlab at videolan.org (Jean-Baptiste Kempf (@jbk)) Date: Tue, 29 Nov 2022 23:23:21 +0100 Subject: [www-doc] [Git][VideoLAN.org/websites][master] Update libbluray to 1.3.4 Message-ID: <63868659c9b34_43b1030269425716b4@gitlab.mail> Jean-Baptiste Kempf pushed to branch master at VideoLAN organization / websites Commits: 680b4c68 by Jean-Baptiste Kempf at 2022-11-29T23:23:12+01:00 Update libbluray to 1.3.4 - - - - - 1 changed file: - www.videolan.org/developers/libbluray.php Changes: ===================================== www.videolan.org/developers/libbluray.php ===================================== @@ -4,7 +4,7 @@ $new_design = true; require($_SERVER["DOCUMENT_ROOT"]."/include/header.php"); - $libbluray_version = "1.3.3"; + $libbluray_version = "1.3.4"; ?>