[gentoo-announce] [ GLSA 201909-02 ] VLC: Multiple vulnerabilities - gentoo-announce

From:	Thomas Deutschmann <whissi@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 201909-02 ] VLC: Multiple vulnerabilities
Date:	Fri, 06 Sep 2019 16:16:49
Message-Id:	`908b3503-8bc1-f7d4-3779-1d14dfd3bad9@gentoo.org`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 201909-02

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Normal

8

    Title: VLC: Multiple vulnerabilities

9

     Date: September 06, 2019

10

     Bugs: #689974

11

       ID: 201909-02

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in VLC, the worst of which

19

could result in the arbitrary execution of code.

20

21

Background

22

==========

23

24

VLC is a cross-platform media player and streaming server.

25

26

Affected packages

27

=================

28

29

    -------------------------------------------------------------------

30

     Package              /     Vulnerable     /            Unaffected

31

    -------------------------------------------------------------------

32

  1  media-video/vlc              < 3.0.8                    >= 3.0.8

33

34

Description

35

===========

36

37

Multiple vulnerabilities have been discovered in VLC. Please review the

38

CVE identifiers referenced below for details.

39

40

Impact

41

======

42

43

Please review the referenced CVE identifiers for details.

44

45

Workaround

46

==========

47

48

There is no known workaround at this time.

49

50

Resolution

51

==========

52

53

All VLC users should upgrade to the latest version:

54

55

  # emerge --sync

56

  # emerge --ask --oneshot --verbose ">=media-video/vlc-3.0.8"

57

58

References

59

==========

60

61

[  1 ] CVE-2019-13602

62

       https://nvd.nist.gov/vuln/detail/CVE-2019-13602

63

[  2 ] CVE-2019-13962

64

       https://nvd.nist.gov/vuln/detail/CVE-2019-13962

65

[  3 ] CVE-2019-14437

66

       https://nvd.nist.gov/vuln/detail/CVE-2019-14437

67

[  4 ] CVE-2019-14438

68

       https://nvd.nist.gov/vuln/detail/CVE-2019-14438

69

[  5 ] CVE-2019-14498

70

       https://nvd.nist.gov/vuln/detail/CVE-2019-14498

71

[  6 ] CVE-2019-14533

72

       https://nvd.nist.gov/vuln/detail/CVE-2019-14533

73

[  7 ] CVE-2019-14534

74

       https://nvd.nist.gov/vuln/detail/CVE-2019-14534

75

[  8 ] CVE-2019-14535

76

       https://nvd.nist.gov/vuln/detail/CVE-2019-14535

77

[  9 ] CVE-2019-14776

78

       https://nvd.nist.gov/vuln/detail/CVE-2019-14776

79

[ 10 ] CVE-2019-14777

80

       https://nvd.nist.gov/vuln/detail/CVE-2019-14777

81

[ 11 ] CVE-2019-14778

82

       https://nvd.nist.gov/vuln/detail/CVE-2019-14778

83

[ 12 ] CVE-2019-14970

84

       https://nvd.nist.gov/vuln/detail/CVE-2019-14970

85

86

Availability

87

============

88

89

This GLSA and any updates to it are available for viewing at

90

the Gentoo Security Website:

91

92

 https://security.gentoo.org/glsa/201909-02

93

94

Concerns?

95

=========

96

97

Security is a primary focus of Gentoo Linux and ensuring the

98

confidentiality and security of our users' machines is of utmost

99

importance to us. Any security concerns should be addressed to

100

security@g.o or alternatively, you may file a bug at

101

https://bugs.gentoo.org.

102

103

License

104

=======

105

106

Copyright 2019 Gentoo Foundation, Inc; referenced text

107

belongs to its owner(s).

108

109

The contents of this document are licensed under the

110

Creative Commons - Attribution / Share Alike license.

111

112

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 201909-02
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: VLC: Multiple vulnerabilities
9	Date: September 06, 2019
10	Bugs: #689974
11	ID: 201909-02
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in VLC, the worst of which
19	could result in the arbitrary execution of code.
20
21	Background
22	==========
23
24	VLC is a cross-platform media player and streaming server.
25
26	Affected packages
27	=================
28
29	-------------------------------------------------------------------
30	Package / Vulnerable / Unaffected
31	-------------------------------------------------------------------
32	1 media-video/vlc < 3.0.8 >= 3.0.8
33
34	Description
35	===========
36
37	Multiple vulnerabilities have been discovered in VLC. Please review the
38	CVE identifiers referenced below for details.
39
40	Impact
41	======
42
43	Please review the referenced CVE identifiers for details.
44
45	Workaround
46	==========
47
48	There is no known workaround at this time.
49
50	Resolution
51	==========
52
53	All VLC users should upgrade to the latest version:
54
55	# emerge --sync
56	# emerge --ask --oneshot --verbose ">=media-video/vlc-3.0.8"
57
58	References
59	==========
60
61	[ 1 ] CVE-2019-13602
62	https://nvd.nist.gov/vuln/detail/CVE-2019-13602
63	[ 2 ] CVE-2019-13962
64	https://nvd.nist.gov/vuln/detail/CVE-2019-13962
65	[ 3 ] CVE-2019-14437
66	https://nvd.nist.gov/vuln/detail/CVE-2019-14437
67	[ 4 ] CVE-2019-14438
68	https://nvd.nist.gov/vuln/detail/CVE-2019-14438
69	[ 5 ] CVE-2019-14498
70	https://nvd.nist.gov/vuln/detail/CVE-2019-14498
71	[ 6 ] CVE-2019-14533
72	https://nvd.nist.gov/vuln/detail/CVE-2019-14533
73	[ 7 ] CVE-2019-14534
74	https://nvd.nist.gov/vuln/detail/CVE-2019-14534
75	[ 8 ] CVE-2019-14535
76	https://nvd.nist.gov/vuln/detail/CVE-2019-14535
77	[ 9 ] CVE-2019-14776
78	https://nvd.nist.gov/vuln/detail/CVE-2019-14776
79	[ 10 ] CVE-2019-14777
80	https://nvd.nist.gov/vuln/detail/CVE-2019-14777
81	[ 11 ] CVE-2019-14778
82	https://nvd.nist.gov/vuln/detail/CVE-2019-14778
83	[ 12 ] CVE-2019-14970
84	https://nvd.nist.gov/vuln/detail/CVE-2019-14970
85
86	Availability
87	============
88
89	This GLSA and any updates to it are available for viewing at
90	the Gentoo Security Website:
91
92	https://security.gentoo.org/glsa/201909-02
93
94	Concerns?
95	=========
96
97	Security is a primary focus of Gentoo Linux and ensuring the
98	confidentiality and security of our users' machines is of utmost
99	importance to us. Any security concerns should be addressed to
100	security@g.o or alternatively, you may file a bug at
101	https://bugs.gentoo.org.
102
103	License
104	=======
105
106	Copyright 2019 Gentoo Foundation, Inc; referenced text
107	belongs to its owner(s).
108
109	The contents of this document are licensed under the
110	Creative Commons - Attribution / Share Alike license.
111
112	https://creativecommons.org/licenses/by-sa/2.5