[vlc-devel] [PATCH] security: Remove existing backdoor (CVE #5U5H1)

Francois Cartegnie fcvlcdev at free.fr
Sat Apr 1 12:01:05 CEST 2017


After the Vault 7 revelations, it's not surprising
to find some real backdoor in our code.

It was found in the Qt interfaces menus and was
there since a long time.

proof: http://i.imgur.com/SlKS8pt.png

For French, backdoors have always been an "issue".
The provided patch closes that door.
---
 modules/gui/qt/pixmaps/menus/exit.svgz     | Bin 1687 -> 1467 bytes
 modules/gui/qt/pixmaps/menus/exit_16px.png | Bin 417 -> 230 bytes
 2 files changed, 0 insertions(+), 0 deletions(-)

diff --git a/modules/gui/qt/pixmaps/menus/exit.svgz b/modules/gui/qt/pixmaps/menus/exit.svgz
index 6858c9e687224757dd4d53346e968ec3b06a3c37..5cc26e336c3349dec6a6315497961c084d31c498 100644
GIT binary patch
literal 1467
zcmV;s1w{HEiwFP!000000Hsz*Z{s!;zUNo4%4G(%C at vBuI<^b6gDK|PPSN8)k!V|u
zB&s64<=6L7)?&vVOn^EFK)r?E+aDLd9IF!TRci`eFFlHhhg6;Eyr?%z at 2{_){lr7Y
zrgff{x>ifC*4{6xhs966kA7=aYE_O7h25er^^3{UMxhT|Ynyox91aIu^hB)NP4E%<
z{_5djVfLE`gb?7?W}atDuUBYxZP^LtS)fW)soI)=Vj6gpcs7Y=4!zi`OjnhzO{ZC#
z#|z;$Uystxngj2IsFX4wEMUwB3E!M*n;!jZRj~1%DkFphz?&rBCp9+^&<6fT at qvJi
z-nE%pgPy{*vcadXpGKxnaBlO9Yle7Up<V^KPAg at aG*c!R=$-yWhG|DQ6uI5Pr|7=6
zs at QDp__;6C;a7cJdIS+f1?tH~zVyH^!6h4vns;DJuW6N0?fwjA?5PCWx+qJ(-IZ#t
z_NvzT*^|Mn`DhZsl3|M4vu^MEJlC0XX6dP8VKKnIUaPBPqg(3(h&sy!TV1JOou#c+
zn>yH+**UiE6jV9~Lrk#Q6~VtYXo_Q%HYR`~+nK;2e50Z{;-=o*MLFgT<W7pa%+tVJ
zEk^5|Nx2K7Q$VOmH&CdhZkOKUy8C%&#<Om7)ebDt{jOLV;#=4gq^2k9=YLdYtu9rY
z)-Lpv^qfr#IlV{U6}h^{7#(rujX-y~W}D{vu=Lnl=Ao#8;rHdlB5|YMON=E(h#W+q
zp2k3hG#cn;s}IhZrDxlndVAli))gRyI3b)TZ at C#%t;BI8dC2$;6Woiipe&Th4YRlN
zcqalq>*Qd+!>iI`Q5CN$pE5PU?%EcnnO~+S)n2zy at 2ty^x$kbr^PitxJ9hllV&XxN
z&f*B!lbZ|2lcRY9(Z$daLMrG;R8`};wwv(LNZl8vcy?`jVFbw5DG>8FR8yx-FYj(I
zi&`07m#1C~1s9#r**_ at iwtzsu-0nuvjEpxn+7xFho5^eQoxUJrzAi#j>g>hYwoXg)
zKT)GujJb>@WArY1^d9u!w*6O&O4&3|Z90|wKoJp_kWE-Z^FKa)UM;e0{<m&l1|WnS
zCw<mC=o*mAvpKAZDz&Skf{t_>=4Y6|i(q0n8CM6>73WJ}ICrD)?yk+Vs&GodpB4u8
z7k78(jk~L`rRqHEZG+QjZZP-(qH1j>|J)Z8cnCJT%1GPa+cb9>xD4zyCk$b3K>Dn1
zCfoZp;)s4XA?GkVVYiZ}j?@pVIeqdb9lc%~Wv3P%;G714uyd9C7$(l+{2eg#K1_Hn
zhie}lE+Ad^t5ruEWX4<-T_*<-6z6MPJXeb*wcE3hD<LF8%t;u<Y{oH<5*dexVU{FP
z&ioitLPJUz%20?2WwDr1EMm@)zzGaZHiIe11dGORN-*Q0B%niP1am3`X9yl3?xGkd
zg2O59C?R1HP-IA=kfRa-9*>0#XFkQ8lOzFHkfV&mQS68`;xTokIEEn)Bv|(m;Rym>
zOd`P?B at Q{I==EYXd=nrY$#J7xJS*mp&oZMqd+Od8Ly7>C@|Z>Bb^`0VhOMbvA7=4B
zwYyfi8gb#>On{q^QhEohhL<lCL#tm at ckV?j>{H`9&y77emhc+>KxTgO@#bPK6LG5r
zE!!5y4-lXvgvkS8hCg_Mvsfk&C4!@fMu~{KGm~+Y#FT%$Hn2DA(WO(c-pY%jJx8nO
zUPX(#*#kitD$l(!a4Z-TWSX_GbU23Q<Pn?3^0>+w?9$|7HukT87=zU$Os+?%!-BeE
z(-yhR=Uoe*Zk~`&_x<gFA^(yHB9cVh#G%W`)It~UOt at 9KUWE0Vx!>)e|4#AT at hu#Q
zU5`dMB9e72N+G3^B|w4_rJTErN=jnMq2DOQp#*hkK0m at F2^k5)PJ%@-pPJ%bA^Sl=
VoJY#WEvx-z^&gDUeK-FN000a-&)xt4

literal 1687
zcmV;I259*oiwFP!000000G(Fbj@!5yzMrRHH8%-rQ9MYb<k()I4YpWdfdbtPdb!X@
z99xYnsuF#gr|(Znl;yFLEb74k)c2o{<m#vMzD7sY^_6bc0mURhsws3?HQROY<@cY%
zG(f${n=-F;qt-#AgP%4}tG|RH`g^Bxqe^tD%ntq1eC><8Rp`Ucn06UOr_%{nBZzgk
zjXt6<+&n$4`s4NqAp~}tepwdlU=(N%UF{glB2u;5tH$&Z#WV`8?8TM6u-2=iD)fG@
zo8Cz_{qu~uD_<vW>&=NfCYohgL|DXF2pnO5X-s|&Z$-h!N1}`n5&`YX`RBNn=NeM+
zO=lc+ZXMF!!v7 at T0o?0DSEyHzRJc(l`uzLni5L=GnsTPbXaC0TO-Y)3ulhDGR3CZV
z$<O+MI^a~5W(S|beeG1W-I?k0SgF(B^m!c+L=Y8dgsXBLKo$hgn0IRFjID#VQ@!er
zgR$ORYQSErx(>TTt(NMj8eI;Nc(<05O9aO$W~j?jnho+}{L4}oHlTH&&XvJn`t4SQ
zI=8wrAsA8vU$oPE6}=XDXVkWdj&(8Q*Pf!iF2R{T+8(Otzb1~_>b%d}K7zhH^pQ33
z2NmrZx6SsUnRD4f0W<QDc=5!|YI5KDRN7oxfi~YlXV<!02hXqW=k&bju2h{T2=|*2
zG^DpO7pRN_^~--$VT`U-mp3-=bns@|K{@ZyLshDKcyiskG#Pk6>vwsnPwRl)l1^0v
za5#04OdryHPi2x#-7{q*rpZ|AojzIb*MaE{>Q>R4*86o3XIKy+#VxIX?#!?xlx3-W
zM}lY)oH8P1_Sp6FUAQ9wB$<3j+2`kKU%jc)m*Q&f&~>oc!aBdG?sh<2aJC5jqwpLh
ze0i~h=BS(1l?ExX%m|r_o%i#_BEbOJY}wD43OYh+-`YuZJ3bk)W7StLb`U4iz}Mse
zl{Z-5<n737wZiIBy>9Bu$b_O<OFN$jG2K-VHf(ISRu*K`*6O|*Ft*6%4qHh<QvUxd
zOcoOJ42sI=1I39`9NkafX0=x)FLRUoHuT>j;TdEdE{)~CKL5N~6~*%3y8AllM#$p%
zi#|XT16NrrVNLIIv#Itl9QHo=D{R13bR}3GTQ9F*PywsaEun|^Vp;4fD-!)?U|s%V
zHM=;hrpnZ6<MjLE=pdXXpCcd4<_WDz_1gO&?HM{T2G?y#^X?yAUfK*_Q+JEUv2g3l
z=+*}?ZgLBSZbvO)cfn;yJ~?Py9!vTu at Dlp<wO7W^mp5d&K|LF4|04skl;sZ%&_ at R1
zp$Bf`vKGP0e4LCro2cmfSsOVX$d_;`9%gKscwN`9hSxz}pYn at W;_m$Au2b+vd47=D
z at 1$LL6%^v4m{V9Fes(T^rC72=lGL-YfsJuSJ$3<1U`CQO&E$w}M+;w?%D at IXzzzMI
zy{`Y+eCdZSi)@qF#%Xi2vqE+_kccrSaU$7*W1fJ%7%|L1akdC0ri8|nFjSxz!}^tC
zL9vjWBY{)SQ?^L3V1gynHzk<yI3plK76hUbf-?k<8>>hHA~>9+Lt?@bK(d%5F-J85
zdt8bvUW5=YCus_1fsev+PoxED!X>qklyId0!~h~ZML?4z5zHbo=9Hqh=^FY&0B at 3w
zMVUQUmd`I)K}+_ at y<L3wfj!Eh0_6SX*G&U`pt}(6fMaeBowAJ&iG5may{&CbDZR7P
zz|$LAywhKmJ39sg_jGSpiQT+#tl=^Kfh at xGqtiK8%Cl6wmw^q`Rp$?olQf1M37LgI
zc>gmASL6axlq57sg>+|@$t0DOf3*7#f*8BVJ`kl~Oc3syZ5?n7{mYZ7C8yUS!-A%%
zzi-9|fy7{h#OZuTTMJNk=5L&N#)rqyZN}-RyT_x?*0XIc!N$+w6#^B?2s{$Nmu&o{
zo?%ky8s7K$?2!q|mE8(3A%*<~chml`%6GxVBjiRX!3oKjn;;75&sYi&bP?s;W<R4u
zW*o)=#yHME7-l0(FiB%Z;@EM(z;oZT?=m)K;9bV%-Q;F_dky!S!TNarOtdyutB|MT
z)^U+i0e3RQlP&}lfx$9MPzakr5SqXx4l%+268GblkU{GvJYB at -dgj=bOr(w*&7|M%
zCv?#Dqv)r|XQFWJez at Pv;^X&p&EkXrXK_p}{)(W8Hj+4lpyVPQx#Ag48SF9_+pks;
hC9`GZQcBbJ at 7r(J;k(5g-ayCg=6{ccd^rdZ004SnR{H<|

diff --git a/modules/gui/qt/pixmaps/menus/exit_16px.png b/modules/gui/qt/pixmaps/menus/exit_16px.png
index 27f8fe9339c6921e406ff50309f510f05265a801..81d04024836da3444e6fa2090cc93b76fe312b6b 100644
GIT binary patch
delta 143
zcmV;A0C4}I1LgscI|~lP000ie0hKEb8<9pQc>rTcL_t(IjqQ^m4uCKa1a}Hm{D9~6
zU;QG6pqj9lrhz~ZU=WPE++^>}N-tqQq?Bgc-AMwf8zim3m~);aso#sXhbrGvN at -4b
x_<7?G_yfKXaOeWCT$QQrupI!$82$EeV*@vq7%AS0wod>6002ovPDHLkV1jP}Jfi>r

delta 332
zcmV-S0ki(*0igqsI|~ih000fw0YWI7c#%dYe*qpzL_t(I%cYaQYJ)%=$IT*zWXdb#
z5wc`RLIoEcI%IPb<4Kn!5FC;xsDo=eTks)Ve1k3y?j7qOv;-+s&u>rr2TYCH<lw{I
z!F at kJ?)V)CfV+gsh7fYlG!1R2s(Mu`Fbv~8NfHzzj$?#j2;cYNx-M+nhH0A6bv<hp
zf23)8vijMA+vO7ecH2#mWmzR`5`yR54u}07qA1dT3GP_<ZM6c{>n}E&3bg`CX&HW8
zERfA+z;p@}^D*;zv*2Mo#z(&o95WdFQY*;wyc8&kf}7zGQE}4~Gzz|(2G^qzp4j16
z2G8>>$1x}OQqm^)L6}T%-|ImT1lp++Hre`*M3!YplGII5JY*C_2!a5f=fQCtSeDh?
eNEd&mbNB=$cc0KO97=Hj0000<MNUMnLSTZ4e3DlH

-- 
2.9.3



More information about the vlc-devel mailing list