Advisories » MGASA-2015-0324

Updated vlc packages fix security vulnerability

Publication date: 25 Aug 2015
Modification date: 25 Aug 2015
Type: security
Affected Mageia releases : 5
CVE: CVE-2015-5949

Description

Loren Maggiore of Trail of Bits discovered that the 3GP parser of VLC, a
multimedia player and streamer, could dereference an arbitrary pointer
due to insufficient restrictions on a writable buffer. This could allow
remote attackers to execute arbitrary code via crafted 3GP files
(CVE-2015-5949).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=16623
• http://www.ocert.org/advisories/ocert-2015-009.html
• https://lists.debian.org/debian-security-announce/2015/msg00241.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5949

SRPMS

5/core

• vlc-2.2.1-1.1.mga5

5/tainted

• vlc-2.2.1-1.1.mga5.tainted