http://bugzilla.opensuse.org/show_bug.cgi?id=1206142
Bug ID: 1206142 Summary: VUL-0: CVE-2022-41325: vlc: security update 3.0.18 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/349957/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: dimstar@opensuse.org Reporter: thomas.leroy@suse.com QA Contact: security-team@suse.de Found By: Security Response Team Blocker: ---
CVE-2022-41325
An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.
References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-41325 https://security-tracker.debian.org/tracker/DSA-5297-1 https://www.cve.org/CVERecord?id=CVE-2022-41325 https://www.videolan.org/security/sb-vlc3018.html https://www.synacktiv.com/sites/default/files/2022-11/vlc_vnc_int_overflow-C... https://twitter.com/0xMitsurugi
http://bugzilla.opensuse.org/show_bug.cgi?id=1206142 http://bugzilla.opensuse.org/show_bug.cgi?id=1206142#c1
--- Comment #1 from Thomas Leroy thomas.leroy@suse.com --- Affected: - openSUSE:Backports:SLE-15-SP4 - openSUSE:Backports:SLE-15-SP3
http://bugzilla.opensuse.org/show_bug.cgi?id=1206142
Dominique Leuenberger dimstar@opensuse.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS CC| |dimstar@opensuse.org
http://bugzilla.opensuse.org/show_bug.cgi?id=1206142 http://bugzilla.opensuse.org/show_bug.cgi?id=1206142#c2
Dominique Leuenberger dimstar@opensuse.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Assignee|dimstar@opensuse.org |security-team@suse.de
--- Comment #2 from Dominique Leuenberger dimstar@opensuse.org --- 1044229 State:review By:dimstar When:2022-12-22T11:01:10 maintenance_incident: multimedia:libs/vlc@36750a77c1e28a8cbd0812806ecef0de -> openSUSE:Maintenance (release in openSUSE:Backports:SLE-15-SP3:Update)
1044230 State:review By:dimstar When:2022-12-22T11:01:17 maintenance_incident: multimedia:libs/vlc@36750a77c1e28a8cbd0812806ecef0de -> openSUSE:Maintenance (release in openSUSE:Backports:SLE-15-SP4:Update)
http://bugzilla.opensuse.org/show_bug.cgi?id=1206142 http://bugzilla.opensuse.org/show_bug.cgi?id=1206142#c3
--- Comment #3 from OBSbugzilla Bot bwiedemann+obsbugzillabot@suse.com --- This is an autogenerated message for OBS integration: This bug (1206142) was mentioned in https://build.opensuse.org/request/show/1044227 Factory / vlc https://build.opensuse.org/request/show/1044229 Backports:SLE-15-SP3 / vlc https://build.opensuse.org/request/show/1044230 Backports:SLE-15-SP4 / vlc
-
bugzilla_noreply＠suse.com