Advisories » MGASA-2015-0329

Updated vlc packages fix security vulnerabilities

Publication date: 27 Aug 2015
Modification date: 27 Aug 2015
Type: security
Affected Mageia releases : 4
CVE: CVE-2015-5949

Description

Loren Maggiore of Trail of Bits discovered that the 3GP parser of VLC, a
multimedia player and streamer, could dereference an arbitrary pointer
due to insufficient restrictions on a writable buffer. This could allow
remote attackers to execute arbitrary code via crafted 3GP files
(CVE-2015-5949).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=16631
• http://www.ocert.org/advisories/ocert-2015-009.html
• https://lists.debian.org/debian-security-announce/2015/msg00241.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5949

SRPMS

4/tainted

• vlc-2.1.6-1.1.mga4.tainted

4/core

• vlc-2.1.6-1.1.mga4