- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 201411-01
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal
    Title: VLC: Multiple vulnerabilities
     Date: November 05, 2014
     Bugs: #279340, #285370, #316709, #332361, #350933, #352206,
           #352776, #353326, #360189, #363359, #370321, #375167,
           #385953, #395543, #408881, #414409, #424435, #442758,
           #450438, #454650, #476436, #486902, #493710, #499806
       ID: 201411-01

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======
Multiple vulnerabilities have been found in VLC, the worst of which
could lead to user-assisted execution of arbitrary code.

Background
=========
VLC is a cross-platform media player and streaming server.

Affected packages
================
    -------------------------------------------------------------------
     Package              /     Vulnerable     /            Unaffected
    -------------------------------------------------------------------
  1  media-video/vlc              < 2.1.2                    >= 2.1.2

Description
==========
Multiple vulnerabilities have been discovered in VLC. Please review the
CVE identifiers referenced below for details.

Impact
=====
A remote attacker could entice a user to open a specially crafted media
file using VLC, possibly resulting in execution of arbitrary code with
the privileges of the process or a Denial of Service condition.

Workaround
=========
There is no known workaround at this time.

Resolution
=========
All VLC users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=media-video/vlc-2.1.2"

References
=========
[  1 ] CVE-2010-1441
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1441
[  2 ] CVE-2010-1442
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1442
[  3 ] CVE-2010-1443
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1443
[  4 ] CVE-2010-1444
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1444
[  5 ] CVE-2010-1445
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1445
[  6 ] CVE-2010-2062
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2062
[  7 ] CVE-2010-2937
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2937
[  8 ] CVE-2010-3124
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3124
[  9 ] CVE-2010-3275
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3275
[ 10 ] CVE-2010-3276
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3276
[ 11 ] CVE-2010-3907
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3907
[ 12 ] CVE-2011-0021
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0021
[ 13 ] CVE-2011-0522
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0522
[ 14 ] CVE-2011-0531
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0531
[ 15 ] CVE-2011-1087
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1087
[ 16 ] CVE-2011-1684
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1684
[ 17 ] CVE-2011-2194
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2194
[ 18 ] CVE-2011-2587
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2587
[ 19 ] CVE-2011-2588
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2588
[ 20 ] CVE-2011-3623
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3623
[ 21 ] CVE-2012-0023
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0023
[ 22 ] CVE-2012-1775
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1775
[ 23 ] CVE-2012-1776
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1776
[ 24 ] CVE-2012-2396
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2396
[ 25 ] CVE-2012-3377
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3377
[ 26 ] CVE-2012-5470
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5470
[ 27 ] CVE-2012-5855
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5855
[ 28 ] CVE-2013-1868
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1868
[ 29 ] CVE-2013-1954
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1954
[ 30 ] CVE-2013-3245
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-3245
[ 31 ] CVE-2013-4388
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4388
[ 32 ] CVE-2013-6283
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6283
[ 33 ] CVE-2013-6934
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6934

Availability
===========
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

 https://security.gentoo.org/glsa/201411-01

Concerns?
========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
======
Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5/

Gentoo: GLSA-201411-01: VLC: Multiple vulnerabilities

Multiple vulnerabilities have been found in VLC, the worst of which could lead to user-assisted execution of arbitrary code.

Summary

Multiple vulnerabilities have been discovered in VLC. Please review the CVE identifiers referenced below for details.

Resolution

All VLC users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=media-video/vlc-2.1.2"

References

[ 1 ] CVE-2010-1441 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1441 [ 2 ] CVE-2010-1442 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1442 [ 3 ] CVE-2010-1443 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1443 [ 4 ] CVE-2010-1444 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1444 [ 5 ] CVE-2010-1445 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1445 [ 6 ] CVE-2010-2062 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2062 [ 7 ] CVE-2010-2937 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2937 [ 8 ] CVE-2010-3124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3124 [ 9 ] CVE-2010-3275 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3275 [ 10 ] CVE-2010-3276 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3276 [ 11 ] CVE-2010-3907 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3907 [ 12 ] CVE-2011-0021 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0021 [ 13 ] CVE-2011-0522 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0522 [ 14 ] CVE-2011-0531 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0531 [ 15 ] CVE-2011-1087 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1087 [ 16 ] CVE-2011-1684 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1684 [ 17 ] CVE-2011-2194 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2194 [ 18 ] CVE-2011-2587 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2587 [ 19 ] CVE-2011-2588 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2588 [ 20 ] CVE-2011-3623 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3623 [ 21 ] CVE-2012-0023 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0023 [ 22 ] CVE-2012-1775 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1775 [ 23 ] CVE-2012-1776 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1776 [ 24 ] CVE-2012-2396 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2396 [ 25 ] CVE-2012-3377 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3377 [ 26 ] CVE-2012-5470 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5470 [ 27 ] CVE-2012-5855 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5855 [ 28 ] CVE-2013-1868 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1868 [ 29 ] CVE-2013-1954 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1954 [ 30 ] CVE-2013-3245 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-3245 [ 31 ] CVE-2013-4388 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4388 [ 32 ] CVE-2013-6283 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6283 [ 33 ] CVE-2013-6934 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6934

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201411-01

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity
Severity: Normal
Title: VLC: Multiple vulnerabilities
Date: November 05, 2014
Bugs: #279340, #285370, #316709, #332361, #350933, #352206,
ID: 201411-01

Synopsis

Multiple vulnerabilities have been found in VLC, the worst of which could lead to user-assisted execution of arbitrary code.

Background

VLC is a cross-platform media player and streaming server.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-video/vlc < 2.1.2 >= 2.1.2

Impact

===== A remote attacker could entice a user to open a specially crafted media file using VLC, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Related News

24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
30.Lock Globe Motherboard Esm H320
1 - 2 min read
The SPDX 3.0 release marks a significant milestone in software management, particularly for Linux admins, infosec professionals, internet security
11.Locks IsometricPattern Esm H320
2 - 3 min read
Open Source maintainers and developers have been warned about the continued wave of attacks aimed at project maintainers similar to those recently
28.Lock Globe Esm H320
1 - 2 min read
A resurgence of cyberattacks targeting Linux systems in Asian campaigns through the utilization of the Pupy Remote Access Trojan (RAT) has been
27.Tablet Connections Blocks Lock Esm H320
2 - 4 min read
Canonical has recently announced the Beta release of Ubuntu Linux 24.04 LTS , codenamed "Noble Numbat." This release aims to continue Ubuntu's
21.Globe RadiatingCode Esm H320
2 - 3 min read
The open-source movement has come a long way, from its origins in the 1960s and 1970s to becoming an integral part of organizations worldwide.
13.Lock StylizedMotherboard Esm H320
2 - 3 min read
The Rust-based Edera project demonstrates a unique approach to container security that addresses cloud-native computing challenges. Let's examine
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved