Debian Package Tracker

general

source: vlc (main)
version: 3.0.7.1-3
maintainer: Debian Multimedia Maintainers (archive) [DMD]
uploaders: Mohammed Adnène Trojette [DMD] – Loic Minier [DMD] – Benjamin Drung [DMD] – Mateusz Łukasik [DMD] – Edward Wang [DMD] – Christophe Mutricy [DMD] – Sebastian Ramacher [DMD] – Reinhard Tartler [DMD]
arch: all any
std-ver: 4.4.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.2.7-1~deb8u1
o-o-sec: 2.2.7-1~deb8u1
oldstable: 3.0.6-0+deb9u1
old-sec: 3.0.7-0+deb9u1
old-p-u: 3.0.7-0+deb9u1
stable: 3.0.7-1
testing: 3.0.7.1-2
unstable: 3.0.7.1-3

versioned links

2.2.7-1~deb8u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.2.7-1~deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.0.6-0+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.0.7-0+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.0.7-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.0.7.1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.0.7.1-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libvlc-bin
libvlc-dev
libvlc5
libvlccore-dev
libvlccore9
vlc (21 bugs: 0, 16, 5, 0)
vlc-bin
vlc-data
vlc-l10n
vlc-plugin-access-extra
vlc-plugin-base
vlc-plugin-fluidsynth
vlc-plugin-jack (2 bugs: 0, 2, 0, 0)
vlc-plugin-notify
vlc-plugin-qt
vlc-plugin-samba
vlc-plugin-skins2
vlc-plugin-svg
vlc-plugin-video-output
vlc-plugin-video-splitter
vlc-plugin-visualization

action needed

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2019-13962: lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
CVE-2019-13615: VideoLAN VLC media player 3.0.7.1 has a heap-based buffer over-read in mkv::demux_sys_t::FreeUnused() in modules/demux/mkv/demux.cpp when called from mkv::Open in modules/demux/mkv/mkv.cpp.

Please fix them.

Created: 2019-07-17 Last update: 2019-07-20 17:29

3 security issues in stretch high

There are 3 open security issues in stretch.

1 important issue:

CVE-2019-13962: lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.

2 issues skipped by the security teams:

CVE-2019-13615: VideoLAN VLC media player 3.0.7.1 has a heap-based buffer over-read in mkv::demux_sys_t::FreeUnused() in modules/demux/mkv/demux.cpp when called from mkv::Open in modules/demux/mkv/mkv.cpp.
CVE-2019-13602: An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.

Please fix them.

Created: 2019-07-15 Last update: 2019-07-20 17:29

3 security issues in jessie high

There are 3 open security issues in jessie.

3 important issues:

CVE-2019-13962: lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
CVE-2019-13615: VideoLAN VLC media player 3.0.7.1 has a heap-based buffer over-read in mkv::demux_sys_t::FreeUnused() in modules/demux/mkv/demux.cpp when called from mkv::Open in modules/demux/mkv/mkv.cpp.
CVE-2019-13602: An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.

Please fix them.

Created: 2019-07-15 Last update: 2019-07-20 17:29

3 security issues in buster high

There are 3 open security issues in buster.

1 important issue:

CVE-2019-13962: lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.

2 issues skipped by the security teams:

CVE-2019-13615: VideoLAN VLC media player 3.0.7.1 has a heap-based buffer over-read in mkv::demux_sys_t::FreeUnused() in modules/demux/mkv/demux.cpp when called from mkv::Open in modules/demux/mkv/mkv.cpp.
CVE-2019-13602: An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.

Please fix them.

Created: 2019-07-15 Last update: 2019-07-20 17:29

2 security issues in bullseye high

There are 2 open security issues in bullseye.

2 important issues:

CVE-2019-13962: lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
CVE-2019-13615: VideoLAN VLC media player 3.0.7.1 has a heap-based buffer over-read in mkv::demux_sys_t::FreeUnused() in modules/demux/mkv/demux.cpp when called from mkv::Open in modules/demux/mkv/mkv.cpp.

Please fix them.

Created: 2019-07-15 Last update: 2019-07-20 17:29

1 bug tagged help in the BTS normal

The BTS contains 1 bug tagged help, please consider helping the maintainer in dealing with it.

Created: 2019-03-21 Last update: 2019-07-21 08:11

Depends on packages which need a new maintainer normal

The packages that vlc depends on which need a new maintainer are:

vcdimager (#884074)
- Build-Depends: libvcdinfo-dev
libcdio (#881719)
- Build-Depends: libiso9660-dev

Created: 2017-12-02 Last update: 2019-07-21 07:14

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2016-04-06 Last update: 2019-07-21 02:31

AppStream hints: 3 warnings normal

AppStream found metadata issues for packages:

vlc: 3 warnings

You should get rid of them to provide more metadata about this software.

Created: 2019-06-08 Last update: 2019-06-08 06:24

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2018-09-30 Last update: 2018-09-30 18:15

testing migrations

This package will soon be part of the auto-x265 transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-liblivemedia transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-libplacebo transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Too young, only 1 of 2 days old
- missing build on mipsel: libvlc-bin, libvlc-dev, libvlc5, libvlccore-dev, libvlccore9, vlc, vlc-bin, vlc-plugin-access-extra, vlc-plugin-base, vlc-plugin-fluidsynth, vlc-plugin-jack, vlc-plugin-notify, vlc-plugin-qt, vlc-plugin-samba, vlc-plugin-skins2, vlc-plugin-svg, vlc-plugin-video-output, vlc-plugin-video-splitter, vlc-plugin-visualization (from 3.0.7.1-2)
- old binaries left on all: vlc-data, vlc-l10n (from 3.0.7.1-2) (but ignoring cruft, so nevermind)
- Piuparts tested OK - https://piuparts.debian.org/sid/source/v/vlc.html
- Required age reduced by 3 days because of autopkgtest
- Not considered

news

[rss feed]

[2019-07-20] Accepted vlc 3.0.7.1-3 (source) into unstable (Sebastian Ramacher)
[2019-07-18] vlc 3.0.7.1-2 MIGRATED to testing (Debian testing watch)
[2019-07-15] Accepted vlc 3.0.7.1-2 (source) into unstable (Sebastian Ramacher)
[2019-07-09] vlc 3.0.7.1-1 MIGRATED to testing (Debian testing watch)
[2019-06-24] Accepted vlc 3.0.7.1-1 (source) into unstable (Sebastian Ramacher)
[2019-06-18] Accepted vlc 3.0.7-0+deb9u1 (source) into proposed-updates->stable-new, proposed-updates (Sebastian Ramacher)
[2019-06-11] Accepted vlc 3.0.7-0+deb9u1 (source) into stable->embargoed, stable (Sebastian Ramacher)
[2019-06-11] vlc 3.0.7-1 MIGRATED to testing (Debian testing watch)
[2019-06-07] Accepted vlc 3.0.7-1 (source) into unstable (Sebastian Ramacher)
[2019-01-29] Accepted vlc 3.0.6-0+deb9u1 (source) into proposed-updates->stable-new, proposed-updates (Sebastian Ramacher)
[2019-01-13] vlc 3.0.6-1 MIGRATED to testing (Debian testing watch)
[2019-01-12] Accepted vlc 3.0.6-0+deb9u1 (source) into stable->embargoed, stable (Sebastian Ramacher)
[2019-01-10] Accepted vlc 3.0.6-1 (source) into unstable (Sebastian Ramacher)
[2019-01-04] Accepted vlc 3.0.5-2 (source) into unstable (Sebastian Ramacher)
[2018-12-31] vlc 3.0.5-1 MIGRATED to testing (Debian testing watch)
[2018-12-27] Accepted vlc 3.0.5-1 (source) into unstable (Sebastian Ramacher)
[2018-12-17] vlc 3.0.4-4 MIGRATED to testing (Debian testing watch)
[2018-12-09] Accepted vlc 3.0.4-4 (source) into unstable (Sebastian Ramacher)
[2018-10-25] vlc 3.0.4-3 MIGRATED to testing (Debian testing watch)
[2018-10-11] Accepted vlc 3.0.4-3 (source) into unstable (Sebastian Ramacher)
[2018-09-26] vlc 3.0.4-2 MIGRATED to testing (Debian testing watch)
[2018-09-20] Accepted vlc 3.0.4-2 (source) into unstable (Sebastian Ramacher)
[2018-09-03] vlc 3.0.4-1 MIGRATED to testing (Debian testing watch)
[2018-08-31] Accepted vlc 3.0.4-1 (source) into unstable (Sebastian Ramacher)
[2018-08-30] Accepted vlc 3.0.3-1-4 (source) into unstable (Sebastian Ramacher)
[2018-08-15] vlc 3.0.3-1-3 MIGRATED to testing (Debian testing watch)
[2018-08-04] Accepted vlc 3.0.3-1-3 (source) into unstable (Sebastian Ramacher)
[2018-07-24] vlc 3.0.3-1-2 MIGRATED to testing (Debian testing watch)
[2018-07-21] Accepted vlc 3.0.3-1-0+deb9u1 (source) into proposed-updates->stable-new, proposed-updates (Sebastian Ramacher)
[2018-07-19] Accepted vlc 3.0.3-1-2 (source) into unstable (Sebastian Ramacher)

bugs [bug history graph]

all: 44 46
RC: 0
I&N: 33 34
M&W: 11 12
F&P: 0
patch: 0
help: 1

links

homepage
buildd: logs, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
security tracker
screenshots
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.0.7.1-2
51 bugs (1 patch)