openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2597-1 Rating: moderate References: #1041907 #1057736 Cross-References: CVE-2017-9300 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for vlc to version 2.2.6 fixes several issues. This security issue was fixed: - CVE-2017-9300: Heap corruption allowed remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted FLAC file (bsc#1041907). These non-security issues were fixed: - Stop depending on libkde4-devel: It's only used to find the install path for kde4, but configure falls back to the correct default for openSUSE anyway (boo#1057736). - Disable vnc access module For the various other fixes introduced by 2.2.6 please see the changelog. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1101=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): vlc-lang-2.2.6-32.3.1 - openSUSE Leap 42.2 (x86_64): libvlc5-2.2.6-32.3.1 libvlc5-debuginfo-2.2.6-32.3.1 libvlccore8-2.2.6-32.3.1 libvlccore8-debuginfo-2.2.6-32.3.1 vlc-2.2.6-32.3.1 vlc-codec-gstreamer-2.2.6-32.3.1 vlc-codec-gstreamer-debuginfo-2.2.6-32.3.1 vlc-debuginfo-2.2.6-32.3.1 vlc-debugsource-2.2.6-32.3.1 vlc-devel-2.2.6-32.3.1 vlc-noX-2.2.6-32.3.1 vlc-noX-debuginfo-2.2.6-32.3.1 vlc-qt-2.2.6-32.3.1 vlc-qt-debuginfo-2.2.6-32.3.1 References: https://www.suse.com/security/cve/CVE-2017-9300.html https://bugzilla.suse.com/1041907 https://bugzilla.suse.com/1057736