From gitlab at videolan.org Wed Nov 1 22:24:31 2023 From: gitlab at videolan.org (Jean-Baptiste Kempf (@jbk)) Date: Wed, 01 Nov 2023 23:24:31 +0100 Subject: [www-doc] [Git][VideoLAN.org/websites][master] Update counters to 3.0.20 Message-ID: <6542d01f14bc2_1e84e643514e904057981@gitlab.mail> Jean-Baptiste Kempf pushed to branch master at VideoLAN organization / websites Commits: ec0c7df9 by Jean-Baptiste Kempf at 2023-11-01T23:24:16+01:00 Update counters to 3.0.20 - - - - - 1 changed file: - www.videolan.org/include/os-specific.php Changes: ===================================== www.videolan.org/include/os-specific.php ===================================== @@ -1,10 +1,10 @@ Jean-Baptiste Kempf pushed to branch master at VideoLAN organization / websites Commits: 7c7e9da3 by Felix Paul K?hne at 2023-11-03T12:45:14+01:00 VLC 3.0.19/20: add release documentation This fixes vlc#28140 - - - - - 6 changed files: - www.videolan.org/news.msg - www.videolan.org/security/index.php - + www.videolan.org/security/sb-vlc3019.php - + www.videolan.org/security/sb-vlc3020.php - + www.videolan.org/vlc/releases/3.0.20.php - www.videolan.org/vlc/releases/index.php Changes: ===================================== www.videolan.org/news.msg ===================================== @@ -1,5 +1,7 @@ # Comments begin with a # # New topics begin with mechanism# +|2 November 2023|VLC 3.0.20|Today, VideoLAN is publishing the 3.0.20 release of VLC, which is a medium update to VLC's 3.0 branch: it updates codecs, fixes a FLAC quality issue and improves playback of numerous formats including improved subtitles rendering. It also fixes a freeze when using frame-by-frame actions. On macOS, audio layout problems are resolved. Finally, we update the user interface translations and add support for more. Additional details on the release page. This release also fixes two security issues, which are detailed here and there. + |3 May 2023|VLC for iOS, iPadOS and Apple TV 3.4.0|We are happy to announce a major update of VLC for iOS, iPadOS and tvOS adding a new audio playback interface, CarPlay integration, various improvements to the local media library and iterations to existing features such as WiFi Sharing. Notably, we also added maintenance improvements to the port to tvOS including support for the Apple Remote's single click mode. See the press release for details. |29 November 2022|VLC 3.0.18|Today, VideoLAN is publishing the 3.0.18 release of VLC, which adds support for a few formats, improves adaptive streaming support, fixes some crashes and updates many third party libraries. More details on the release page. This release also fixes multiple security issues, which are detailed here. ===================================== www.videolan.org/security/index.php ===================================== @@ -19,6 +19,17 @@
Those bulletins are related to each VLC release and can be made of multiple security issues, internal and external.
++Summary : Two vulnerabilities fixed in VLC media player +Date : November 2023 +Affected versions : VLC media player 3.0.18 and earlier +ID : VideoLAN-SB-VLC-3019 ++ +
Fix potential arbitrary code execution with system priviledges on uninstallation on Windows (!4292, CVE-2023-46814)
+ +If successful, a malicious third party could trigger an execution of an arbitrary binary on uninstallation of VLC with system priviledges.
+We have not seen exploits performing code execution through this vulnerability.
+Exploitation of this issue requires the user to explicitly uninstall VLC using the provided uninstaller.
+ +Keep VLC installed until updated to version 3.0.19 or later.
+ +VLC media player 3.0.19 addresses the issue.
+ +The NSIS uninstaller vulnerability was reported by Patrick Murphy of the Lockheed Martin Red Team (!4292, CVE-2023-46814).
+ +VLC 3.0.19 also bumps some dependencies, notably zlib and vpx, following the publication of CVE-2022-37434 and CVE-2023-5217.
+ ++Summary : Vulnerability fixed in VLC media player +Date : November 2023 +Affected versions : VLC media player 3.0.19 and earlier +ID : VideoLAN-SB-VLC-3020 ++ +
A denial of service could be triggered with a maliciously crafted mms stream (out-of-bounds write)
+ +If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user.
+While these issues in themselves are most likely to just crash the player, we can't exclude that they could be combined to leak user informations or remotely execute code. ASLR and DEP help reduce the likelyness of code execution, but may be bypassed.
+We have not seen exploits performing code execution through this vulnerability.
+Exploitation of those issues requires the user to explicitly open a maliciously crafted mms stream.
+ +The user should refrain from opening mms streams from untrusted third parties (or disable the VLC browser plugins), until the patch is applied. +
+ +VLC media player 3.0.20 addresses the issue. +
+ +VLC 3.0 playing 8K 48fps 360 video on Android Galaxy S8 from VideoLAN on Vimeo.
+VLC 3.0 playing 8k60 on Windows 10 using i7 GPU from VideoLAN on Vimeo.
+Ask your favorite packager for VLC 3.0!
+For any questions related to this release, please contact us.
+VLC media player 3.0.19 addresses the issue.
The NSIS uninstaller vulnerability was reported by Patrick Murphy of the Lockheed Martin Red Team (!4292, CVE-2023-46814).
+The NSIS uninstaller vulnerability was reported by the Lockheed Martin Red Team (!4292, CVE-2023-46814).
VLC 3.0.19 also bumps some dependencies, notably zlib and vpx, following the publication of CVE-2022-37434 and CVE-2023-5217.
View it on GitLab: https://code.videolan.org/VideoLAN.org/websites/-/commit/7fa0c48f91cad72d0b074d32d94d29e37953749e -- View it on GitLab: https://code.videolan.org/VideoLAN.org/websites/-/commit/7fa0c48f91cad72d0b074d32d94d29e37953749e You're receiving this email because of your account on code.videolan.org. VideoLAN code repository instance From gitlab at videolan.org Tue Nov 21 12:30:20 2023 From: gitlab at videolan.org (Jean-Baptiste Kempf (@jbk)) Date: Tue, 21 Nov 2023 13:30:20 +0100 Subject: [www-doc] [Git][VideoLAN.org/websites][master] More stats for 3.0.20 Message-ID: <655ca2dc3b182_1e84e661ab54a862704f6@gitlab.mail> Jean-Baptiste Kempf pushed to branch master at VideoLAN organization / websites Commits: 757373d3 by Jean-Baptiste Kempf at 2023-11-21T13:30:09+01:00 More stats for 3.0.20 - - - - - 1 changed file: - www.videolan.org/vlc/stats/downloads.php Changes: ===================================== www.videolan.org/vlc/stats/downloads.php ===================================== @@ -216,6 +216,8 @@ "3.0.16" => array( "Windows" => 0, "Macintosh" => 0, "Total" => 0 ), "3.0.17" => array( "Windows" => 0, "Macintosh" => 0, "Total" => 0 ), "3.0.18" => array( "Windows" => 0, "Macintosh" => 0, "Total" => 0 ), + "3.0.19" => array( "Windows" => 0, "Macintosh" => 0, "Total" => 0 ), + "3.0.20" => array( "Windows" => 0, "Macintosh" => 0, "Total" => 0 ), ); $table = array_merge( $table_old, $table_sf ); @@ -520,6 +522,17 @@ "Macintosh" => array( "https://get.videolan.org/vlc/#version#/macosx/vlc-#version#-intel64.dmg?stats", "https://get.videolan.org/vlc/#version#/macosx/vlc-#version#-arm64.dmg?stats", "https://get.videolan.org/vlc/#version#/macosx/vlc-#version#-universal.dmg?stats" ), "Source" => "https://get.videolan.org/vlc/#version#/vlc-#version#.tar.xz?stats", ), + "3.0.19" => array( + "Windows" => array( "https://get.videolan.org/vlc/#version#/win32/vlc-#version#-win32.exe?stats", "https://get.videolan.org/vlc/#version#/win64/vlc-#version#-win64.exe?stats", "https://get.videolan.org/vlc/#version#/win32/vlc-#version#-win32.7z?stats", "https://get.videolan.org/vlc/#version#/win32/vlc-#version#-win32.zip?stats", "https://get.videolan.org/vlc/#version#/win64/vlc-#version#-win64.7z?stats", "https://get.videolan.org/vlc/#version#/win64/vlc-#version#-win64.zip?stats" ), + "Macintosh" => array( "https://get.videolan.org/vlc/#version#/macosx/vlc-#version#-intel64.dmg?stats", "https://get.videolan.org/vlc/#version#/macosx/vlc-#version#-arm64.dmg?stats", "https://get.videolan.org/vlc/#version#/macosx/vlc-#version#-universal.dmg?stats" ), + "Source" => "https://get.videolan.org/vlc/#version#/vlc-#version#.tar.xz?stats", + ), + "3.0.20" => array( + "Windows" => array( "https://get.videolan.org/vlc/#version#/win32/vlc-#version#-win32.exe?stats", "https://get.videolan.org/vlc/#version#/win64/vlc-#version#-win64.exe?stats", "https://get.videolan.org/vlc/#version#/win32/vlc-#version#-win32.7z?stats", "https://get.videolan.org/vlc/#version#/win32/vlc-#version#-win32.zip?stats", "https://get.videolan.org/vlc/#version#/win64/vlc-#version#-win64.7z?stats", "https://get.videolan.org/vlc/#version#/win64/vlc-#version#-win64.zip?stats" ), + "Macintosh" => array( "https://get.videolan.org/vlc/#version#/macosx/vlc-#version#-intel64.dmg?stats", "https://get.videolan.org/vlc/#version#/macosx/vlc-#version#-arm64.dmg?stats", "https://get.videolan.org/vlc/#version#/macosx/vlc-#version#-universal.dmg?stats" ), + "Source" => "https://get.videolan.org/vlc/#version#/vlc-#version#.tar.xz?stats", + ), + ); foreach( $table as $key => $t ) View it on GitLab: https://code.videolan.org/VideoLAN.org/websites/-/commit/757373d36b77816251f8898d2e408d109f65fe3e -- View it on GitLab: https://code.videolan.org/VideoLAN.org/websites/-/commit/757373d36b77816251f8898d2e408d109f65fe3e You're receiving this email because of your account on code.videolan.org. VideoLAN code repository instance From gitlab at videolan.org Tue Nov 28 09:45:54 2023 From: gitlab at videolan.org (Jean-Baptiste Kempf (@jbk)) Date: Tue, 28 Nov 2023 10:45:54 +0100 Subject: [www-doc] [Git][VideoLAN.org/websites][master] Update GA tag Message-ID: <6565b6d295ff5_1e84e6711eee187224831@gitlab.mail> Jean-Baptiste Kempf pushed to branch master at VideoLAN organization / websites Commits: c05b564b by Jean-Baptiste Kempf at 2023-11-28T10:45:28+01:00 Update GA tag - - - - - 1 changed file: - www.videolan.org/include/header.php Changes: ===================================== www.videolan.org/include/header.php ===================================== @@ -248,15 +248,14 @@ function start_head( $title, } ?> - +