vlc: CVSS (Max): 7.8

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2022.2874
                            vlc security update
                               13 June 2022

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           vlc
Publisher:         Debian
Operating System:  Debian GNU/Linux
Resolution:        Patch/Upgrade
CVE Names:         CVE-2020-26664  

Original Bulletin: 
   https://www.debian.org/lts/security/2022/dla-3050

Comment: CVSS (Max):  7.8 CVE-2020-26664 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
         CVSS Source: NVD
         Calculator:  https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- - -------------------------------------------------------------------------
Debian LTS Advisory DLA-3050-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                      Sylvain Beucler
June 10, 2022                                 https://wiki.debian.org/LTS
- - -------------------------------------------------------------------------

Package        : vlc
Version        : 3.0.12-0+deb9u1
CVE ID         : CVE-2020-26664
Debian Bug     : 979676

Multiple vulnerabilities were discovered in the VLC media player,
which could result in the execution of arbitrary code or denial of
service if a malformed media file is opened.

For Debian 9 stretch, this problem has been fixed in version
3.0.12-0+deb9u1.

We recommend that you upgrade your vlc packages.

For the detailed security status of vlc please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/vlc

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmKjdWkACgkQDTl9HeUl
XjAZCxAAqIUl0QMrxVCf0NLScm3/95w/8JnO8y2+unwTPL4pf8K9scb2wVIJa9Y0
9W9b9o5yiT8tzhaK8YZrHuQrEMTQmKY53mxHzVamhX0voMvb3wWi4EtlJQxF9N19
5K67uE2h6Ew73izpS8p6LgIqgP/PvwJ1Ufjm9nCyWaeckDSEgjdXAXjSSwEGyEKU
7kHI8evvyCRTsh9FBfuE7jW8fpKTlAwf4PkQtuNrhGeQaZrcAno6JAXqlC7z4SKJ
cbbr4t0z5KERJBenrhAGrtiSqv1/mYEm4xQ4sKEciNPNheZl0lQiOBlwrqek9QFo
c456nHE/lQuizmHwDpssd8WgqNm9iGUPBwbaSaV9PMQ2jopFMDkQ/NcZcf5YG46U
M0PJzn5wEnfbtUi8SznEjLUcTPMRtCb0rmAyNNHvH6cVttzz3zklrpejK37jQOUd
Dsfnt3T9avi9t9EFZTGfD2VKjKha9EN5boReHBLUQMjVdkvIpnKYfOqqq5VfzP9M
qOWMtbhifGRiyhOaAydkIhfU7jJTBdft7totKprJjxaJvGvBzDiWACaaQDHEiMtX
2s4L1KmrTxlpHDM3aNKHtrmydlntbKg5npQmP3K1pQs8LwwR62btUzIHgFBsN/AZ
GafOpL5KweE+Oy2pr6yT+eMI5cDgO8Vw05IQJQK1q4ag3CbEggo=
=7UIh
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/

iQIVAwUBYqaiB8kNZI30y1K9AQhaog//RhUAcFQaKug4pamNm61ArinFDW7cXjwq
AU9dVDC4zY4LbiE0zygahwawpvH39pwNBscqgpjZcwlG3GAtw+X59Hk04iIDJin/
4YDHx9r4yNSPkZOYibi+CzkZgGsa/wZA2IGwH8H38wxGwk7N8DlioaNseGAe1GSx
xSdFhi9ujAqgrueo6tmwnWktPVoLXVizXGccmGRbqIVTM1dHfv50t6y6JEZg34lc
/nw/1gOylHOw+ZIKAkbzLNuYJYYfB12z5Z3TJ0bRqEyIEi9v9hbWqgnbgckc2xYD
FOh3FRraQJfCyrJIe2k0H0tOpdvKdK7/wz9L6yXla8T5flBPzhvB8tQqLfynqZm9
MBn5oH9DjbiV7+ntPpVoRYcTq76ezmqeJwhpUJnkt962pp/u3rckZtIrBdI+xePC
Pr3Vgz/iNTlcZhSJ72C8JPEg1AgrWDpMPFQkQoauIwGmEVuR2EpXw2yOO5VDevvF
P1ZDqbr/fBfMErf4bCAtjn6SgdO9CcAues5kPqE5HX7/L67VBaxQj4D/fBKgdutc
MzFzZ2uSM/RAzXPpLnREhm7ZRlU+KO19WcZ/GPMnZpdRSx6mY8OW4YCRTqbs1x5l
uW+d8Bf+o+VmoaQUo4Na8L2lzBFEdJ0DwMrLfGp3oDZga9rjV7uOoM4YWmuIULnY
ACnJxqphEIM=
=KFrT
-----END PGP SIGNATURE-----