[vlc-devel] Libwebp CVE

[Rémi Denis-Courmont]

Le perjantaina 29. syyskuuta 2023, 19.55.44 EEST Sean McGovern a écrit :
> Hi,
> 
> Do we consume libwebp directly or indirectly?

Directly: no.
Indirectly: no, at least not in our own contribs.

I cannot speak for third party packagers, whose complex layered dependencies 
could cause a transitive dependency from VLC to libwebp. Notably Debian (and 
probably all of its derivatives) have libavcodec depend on libwebp, but there 
is nothing we here can do about it.

-- 
雷米‧德尼-库尔蒙
http://www.remlab.net/