Advisories » MGASA-2016-0221

Updated vlc/mad packages fix security vulnerability

Publication date: 10 Jun 2016
Modification date: 10 Jun 2016
Type: security
Affected Mageia releases : 5
CVE: CVE-2016-5108

Description

A vulnerability was found in processing QuickTime IMA files. VLC does not
check that the number of channels in the input stream is less than or
equal to the size of the buffer, resulting in an out-of-bounds write
potential for remote code execution via a malicious media file
(CVE-2016-5108).

The vlc package has been updated to version 2.2.4, which fixes this issue
and other bugs.

Also, the mad package has been patched to fix an out-of-bounds write which
could cause VLC or other applications linked to that library to crash on
an invalid mp3 file.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=18567
• http://www.openwall.com/lists/oss-security/2016/05/27/7
• http://git.videolan.org/?p=vlc/vlc-2.2.git;a=blob;f=NEWS;h=1af86bef0317c8882acc363a7c8fc5e83097c7bd;hb=888b7e89d78e7073075fc0a007d47b93f4570fab
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5108

SRPMS

5/core

• mad-0.15.1b-16.1.mga5
• vlc-2.2.4-1.mga5

5/tainted

• vlc-2.2.4-1.mga5.tainted