Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.2094
vlc security update
19 July 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: vlc
Publisher: Debian
Operating System: Debian GNU/Linux 9
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2018-11529
Original Bulletin:
http://www.debian.org/security/2018/dsa-4251
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running vlc check for an updated version of the software for their
operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4251-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
July 18, 2018 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : vlc
CVE ID : CVE-2018-11529
A use-after-free was discovered in the MP4 demuxer of the VLC media
player, which could result in the execution of arbitrary code if a
malformed media file is played.
For the stable distribution (stretch), this problem has been fixed in
version 3.0.3-1-0+deb9u1.
We recommend that you upgrade your vlc packages.
For the detailed security status of vlc please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/vlc
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAltPqS8ACgkQEMKTtsN8
TjYWCBAAnI05678eoGjBIod09isdkz3WHRDG7r685ZOr1TH62DEJ6NXuo4ikyJkI
wYY3XdpzwHs7ZM0A3eEQ/kfnt2LWaWQ1fbX9RfnVITflknLtrz9w6Zq7hlWaNXJH
mfT9kQYx45KNHRkdZLkYl1NrZ4QYlgtW56pzYPkifBKfDQ5PmXrsfO73bYIm/tQy
0D1LumXBI6PRgngs6xeR16yr5qnOxtokxjGi/mS2yREkGs1Q/M/gzaXSH0PJZOB1
pO8vy0YG6oXZbkEMImwb7t5HMpACB2AuNyNDUm8qep2G+e0Nuz1yhUlPMGP+tpf/
eiVTxwkK26JC+QSSMvFyryXFgAIERw9DZzuUrWUKbicI14TK2p4syZetFKncbatu
vLzjoKnSCBA5p31eeoWthGdujh2lZ+zLe2Wod8L1xHCXUUzMnVU24u8gTQeteOAg
M5V5BA3bhB/dlvY+d9aO407mHa3Ic9EXzOafU1JktF8pJskqXfHS1i7br1HKyaRY
8uFngho+SKHkEGUgpLr+j460bPl0ojibON/I+ahYQy7vWobYMQ+0Toer4teKcmVX
42pexTOfw3G4FbLLH6J9DZupdk4GqMW+PiBHYZsl1iOzOWXUZ4Dy11FvQmSIU88U
ijfhSfNpNIe5XElQPfutZe52YtcTfJTU23g/HUVgRqrB+yZOBLk=
=1Bpc
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW1ADp2aOgq3Tt24GAQhAORAApcc0DruhNixeKpKo6m4whohIYsXNIW1k
CYq7k/sT48AvoqMoT3zw7G7pyerr4BgbTcOw55LUQsSvJNfFk714C/RVGuaJP1C7
qslDD+FV2Lorf2Kwmz+r0kpJOJLBtYYWV1MUmCWUGqekb8FFcRF7+23u5L4N0OgW
NQspGkuhFushC4+EHLmCutFzvUXwc9wCyqdGstolmrEj38QaPBMcIVRgAZCQWSnD
s6drFb93QxqRH9olHN2p/fbvAf73CA/9kEbmjILqRBQOX0GMfo7bowWfc6AhhcVN
jzh77C2XbCy8SDsX49CjRWb6d6G93kdTjgvJq5oA1JZTojfAyZjWO/SWVXYjje+P
FoNKetfRfmH5sQDg0Txp5Di4FrfqxAUjS6bO14vcGMFRvzlY3pkRTKtcT4nzdi+0
DMljbKx7zV8aYMSn9ZNkcbgzwzdA62ylsggmG8+G6WzMgqofJTVxqgV/Y8RESXzM
tzsb6dArG3PJ1eftnsnW2Vf+sjJcADWezfXHQjhc4hzfGetpR0T3Mxfk5E48b9Nl
t15m4qshyI4JSz057wOsabXIMEhZIDe5CtO2wOha4Rw2AnQFHsfVgZdpF3H2EWwq
THrXRy0Juo2w3BJsI6bCJy8ZAzv8vRgFnUKnrawLhAvZwizflLLDzKVSG9uzann2
GzBUijOklco=
=tXf/
-----END PGP SIGNATURE-----