openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1651-1 Rating: important References: #973354 #984382 Cross-References: CVE-2016-3941 CVE-2016-5108 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for vlc to version 2.1.6 fixes the following issues: These CVE were fixed: - CVE-2016-5108: Reject invalid QuickTime IMA files (boo#984382). - CVE-2016-3941: Heap overflow in processing wav files (boo#973354). These security issues without were fixed: - Fix heap overflow in decomp stream filter. - Fix buffer overflow in updater. - Fix potential buffer overflow in schroedinger encoder. - Fix null-pointer dereference in DMO decoder. - Fix buffer overflow in parsing of string boxes in mp4 demuxer. - Fix SRTP integer overflow. - Fix potential crash in zip access. - Fix read overflow in Ogg demuxer. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-755=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libvlc5-2.1.6-2.10.1 libvlc5-debuginfo-2.1.6-2.10.1 libvlccore7-2.1.6-2.10.1 libvlccore7-debuginfo-2.1.6-2.10.1 vlc-2.1.6-2.10.1 vlc-debuginfo-2.1.6-2.10.1 vlc-debugsource-2.1.6-2.10.1 vlc-devel-2.1.6-2.10.1 vlc-gnome-2.1.6-2.10.1 vlc-gnome-debuginfo-2.1.6-2.10.1 vlc-noX-2.1.6-2.10.1 vlc-noX-debuginfo-2.1.6-2.10.1 vlc-qt-2.1.6-2.10.1 vlc-qt-debuginfo-2.1.6-2.10.1 - openSUSE 13.2 (noarch): vlc-noX-lang-2.1.6-2.10.1 References: https://www.suse.com/security/cve/CVE-2016-3941.html https://www.suse.com/security/cve/CVE-2016-5108.html https://bugzilla.suse.com/973354 https://bugzilla.suse.com/984382