Happy Friday fellow Linux geeks! This week, multiple vulnerabilities have been fixed in VLC, the streaming video player, including a potential buffer overflow in the vnc module that could trigger remote code execution if a malicious vnc URL is deliberately played. With a base score of 7.8 out of 10, it's critical that all users update their systems now.

Have you customized your LinuxSecurity advisories based on the distro(s) you use? If not, we encourage you to do so now! 

Yours in Open Source,

Brittany Signature 150

BCEL

The Discovery 

An important out-of-bounds writing vulnerability (CVE-2022-42920) has been found in The Byte Code Engineering Library (Apache Commons BCEL).

Commons Logo

The Impact

This bug could result in the production of arbitrary bytecode, giving attackers more control over the resulting bytecode than otherwise expected.

The Fix

An update for BCEL that fixes this flaw is now available. We recommend that you update now to protect against attacks leading to compromise.

Your Related Advisories:

Register to Customize Your Advisories

webkit2gtk3

The Discovery 

Nine important security issues have been discovered in webkit2gtk3.
Webkitgtk

The Impact

These vulnerabilities could lead to the disclosure of process memory and sensitive user information, and arbitrary code execution caused by memory corruption.

The Fix

An update has been released for webkit2gtk3 that fixes these bugs. We urge you to update immediately to protect the security and integrity of your systems and the privacy of your sensitive information.

Your Related Advisories:

Register to Customize Your Advisories

VLC

The Discovery 

An important integer overflow vulnerability in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 has been identified (CVE-2022-41325).

Vlc

The Impact

This issue could allow attackers to crash VLC or execute code under some conditions by tricking a user into opening a crafted playlist or connecting to a rogue VNC server.

The Fix

An update for VLC mitigates this dangerous bug. We recommend that you update as soon as possible to prevent exploits leading to compromise.

Your Related Advisories:

Register to Customize Your Advisories