Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2019.0118 vlc security update 14 January 2019 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: vlc Publisher: Debian Operating System: Debian GNU/Linux 9 UNIX variants (UNIX, Linux, OSX) Windows Impact/Access: Denial of Service -- Remote/Unauthenticated Access Confidential Data -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2018-19857 Original Bulletin: http://www.debian.org/security/2019/dsa-4366 Comment: This advisory references vulnerabilities in products which run on platforms other than Debian. It is recommended that administrators running vlc check for an updated version of the software for their operating system. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - - ------------------------------------------------------------------------- Debian Security Advisory DSA-4366-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff January 12, 2019 https://www.debian.org/security/faq - - ------------------------------------------------------------------------- Package : vlc CVE ID : CVE-2018-19857 An integer underflow was discovered in the CAF demuxer of the VLC media player. For the stable distribution (stretch), this problem has been fixed in version 3.0.6-0+deb9u1. We recommend that you upgrade your vlc packages. For the detailed security status of vlc please refer to its security tracker page at: https://security-tracker.debian.org/tracker/vlc Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org - -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlw53uEACgkQEMKTtsN8 TjYgbA//codUcz9c+IhREMe5pF/dAe82Nhl3fjAZdy4SecsfP1etpF1R/unDVDT7 3X4qBZGUEyyKJX75MidhRHgqnKswpoBGtHeY62BmkLoMNP/yiZNdyT2dvoxcgT3L f9zBiPvkKnYzsOEAXTpeiTp+QUPBG/kaYrHEV2FKCSj5aYwLWdcU7/wjfNeTHcmM zkQLc0YsA9FJNTWoyC3DUm3gzIRc1qsQH2BHri1QZoiS7CQ2QHQYr+VATH6WxS4x ofqz91RyH49cw793WucifMxZf/2gqORiTPd6dd8S5PoTkMJglGb64Js6G0zLjup6 D2WoGIpsxVNPti8Z4t4qWMNH2fyGhlgA6brWOD/c011ANh+x8HrWkEaoCFC4K0sI Pn/Q1EZ5ya00sweef+y2Kg9O+xf2nw/iBpfRLW3pQN2Lu6s0TvrbS5IQD6McTtXb yIA64DfFFWgHzdjXiJPfU66/xTQBdyS9wBx51nheA41vStmAPQFXeRoFBWSrc8Yg ac5l4qJImQq6hL46d93HOgLGGg5iJ6O4/iE1uDs72JcruF/WJZ7OfW9ojSNymIRF XNibboQ9xfAGdrdmBpXk8fgJ1ag5L0Vp9CqgjR0HXa8/ONass72V4CM0JYgsqdXs Zo1qP1KCfkdq+o1zgi0/OiTrnRkbA8Dt9WSMOv5nlWT+Kz+zCAc= =HPRG - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIUAwUBXDvZemaOgq3Tt24GAQigAw/2MULO8C6kVKS2u1525jJ6zfW1FR75GKbT UQP1D1dFFcjC3dc4sTiIf2MgihPHhn4L/YyLHFYs2Z1dCEOxydv3eVArJRCUStK7 0/FDZ79SAC0DabMq+MIrmhEhLLJtga+28rHRfe42Z9zQgD2+f1ZqFV663IFAxgi4 vTKWmFgY7oIqebm4iMj5IwOsONJ57Tkr+8hhPwg5Ckw+DZuniaJgkgzshTaLG5MU Y4cuCEwyr6K3S285aDWjy2Z0IfuyW5/WV6Be+HMcZnoUsvwuiBIRqTUiNuH1/hxe 7w7FKFHh2qSIpxRU7yNqpZeZRe7ohqKrx2qsDW0msLi30rALsDefeNdslrxvrOnr 9NVHaRDLEA/KEVHVx7TaWuRIUE2VM0BL7big8H3e4zh+9hzR5e1WfrNuc/p86mnv Jg/l9qZtUvw/Ozr25ipV1os7xklddBUKU90BibsCKaa4rTkWu7Odz3ZU4VPdthwl JAJc8vVbzBGNgK56IGUHXLCrL++vkyCOy8WsfAkkxjflK5fMwkpJcd2jHHiV53A5 5nwUtEAbZF07s1OOt6kJ+v8x0VWAZRkezheIheiyPUPaVzUvcYDSlHEAMdmSK/B+ nw1J1RkzczHOr00Wc4+HGKXt6win4KDjAqVp5W/y/rFAHBxiDSQU3b07q7wCb5yP o88aQX6stQ== =hMYp -----END PGP SIGNATURE-----