Please update VLC (for security issues)

[Joe le Kiffeur]

VLC 2.0.6, 2.0.7, and 2.0.8 contain security fixes.

[Joe le Kiffeur (joelekiffeur)]

VLC is not updated. The last version 2.0.6 and fixes security issues and other bugs.
The priority is high (or critical)

[Benjamin Drung (bdrung)]

I have uploaded vlc 2.0.8-1 to Debian unstable and will sync it.

[Benjamin Drung (bdrung)]

I have prepared 2.0.8 for precise-security, quantal-security, and raring-security. You can get the source package by grabbing the .orig.tar.xz tarball from unstable/saucy and running:

git clone -b precise git://git.debian.org/git/pkg-multimedia/vlc.git
cd vlc
git-buildpackage -S

The quantal/raring package can be retrieved by checking out the quantal/raring branch instead of the precise branch.

All source package build cleanly with pbuilder. I have verified that the raring package installs and runs without issues.

[Launchpad Janitor (janitor)]

This bug was fixed in the package vlc - 2.0.8-0ubuntu0.12.04.1

---------------
vlc (2.0.8-0ubuntu0.12.04.1) precise-security; urgency=low

  * New bug-fixing upstream release (LP: #1186780).
  * SECURITY UPDATE: Denial of service (crash) and possibly execute arbitrary
    code via a crafted MKV file (disputed).
    - Improve resistance and checking against malformed MKV files.
    - CVE-2013-3245
  * SECURITY UPDATE: Two xss vulnerabilities.
    - CVE-2013-3565
  * SECURITY UPDATE: Buffer Overflow in ASF Demuxer.
    - CVE-2013-1954
    - VideoLAN-SA-1302
 -- Benjamin Drung <email address hidden> Thu, 01 Aug 2013 14:25:34 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package vlc - 2.0.8-0ubuntu0.12.10.1

---------------
vlc (2.0.8-0ubuntu0.12.10.1) quantal-security; urgency=low

  * New bug-fixing upstream release (LP: #1186780).
  * SECURITY UPDATE: Denial of service (crash) and possibly execute arbitrary
    code via a crafted MKV file (disputed).
    - Improve resistance and checking against malformed MKV files.
    - CVE-2013-3245
  * SECURITY UPDATE: Two xss vulnerabilities.
    - CVE-2013-3565
  * SECURITY UPDATE: Buffer Overflow in ASF Demuxer.
    - CVE-2013-1954
    - VideoLAN-SA-1302
 -- Benjamin Drung <email address hidden> Thu, 01 Aug 2013 14:41:36 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package vlc - 2.0.8-0ubuntu0.13.04.1

---------------
vlc (2.0.8-0ubuntu0.13.04.1) raring-security; urgency=low

  * New bug-fixing upstream release (LP: #1186780).
  * SECURITY UPDATE: Denial of service (crash) and possibly execute arbitrary
    code via a crafted MKV file (disputed).
    - Improve resistance and checking against malformed MKV files.
    - CVE-2013-3245
  * SECURITY UPDATE: Two xss vulnerabilities.
    - CVE-2013-3565
 -- Benjamin Drung <email address hidden> Thu, 01 Aug 2013 14:47:07 +0200

[Seth Arnold (seth-arnold)]

Great, thanks Benjamin!