Описание
Security update for vlc
This update for vlc fixes the following issues:
Update to version 3.0.20:
- Video Output:
- Fix green line in fullscreen in D3D11 video output
- Fix crash with some AMD drivers old versions
- Fix events propagation issue when double-clicking with mouse wheel
- Decoders:
- Fix crash when AV1 hardware decoder fails
- Interface:
- Fix annoying disappearance of the Windows fullscreen controller
- Demuxers:
- Fix potential security issue (OOB Write) on MMS:// by checking user size bounds
Update to version 3.0.19:
- Core:
- Fix next-frame freezing in most scenarios
- Demux:
- Support RIFF INFO tags for Wav files
- Fix AVI files with flipped RAW video planes
- Fix duration on short and small Ogg/Opus files
- Fix some HLS/TS streams with ID3 prefix
- Fix some HLS playlist refresh drift
- Fix for GoPro MAX spatial metadata
- Improve FFmpeg-muxed MP4 chapters handling
- Improve playback for QNap-produced AVI files
- Improve playback of some old RealVideo files
- Fix duration probing on some MP4 with missing information
- Decoders:
- Multiple fixes on AAC handling
- Activate hardware decoding of AV1 on Windows (DxVA)
- Improve AV1 HDR support with software decoding
- Fix some AV1 GBRP streams, AV1 super-resolution streams and monochrome ones
- Fix black screen on poorly edited MP4 files on Android Mediacodec
- Fix rawvid video in NV12
- Fix several issues on Windows hardware decoding (including 'too large resolution in DxVA')
- Improve crunchyroll-produced SSA rendering
- Video Output:
- Super Resolution scaling with nVidia and Intel GPUs
- Fix for an issue when cropping on Direct3D9
- Multiple fixes for hardware decoding on D3D11 and OpenGL interop
- Fix an issue when playing -90°rotated video
- Fix subtitles rendering blur on recent macOS
- Input:
- Improve SMB compatibility with Windows 11 hosts
- Contribs:
- Update of fluidlite, fixing some MIDI rendering on Windows
- Update of zlib to 1.2.13 (CVE-2022-37434)
- Update of FFmpeg, vpx (CVE-2023-5217), ebml, dav1d, libass
- Misc:
- Improve muxing timestamps in a few formats (reset to 0)
- Fix some rendering issues on Linux with the fullscreen controller
- Fix GOOM visualization
- Fixes for Youtube playback
- Fix some MPRIS inconsistencies that broke some OS widgets on Linux
- Implement MPRIS TrackList signals
- Fix opening files in read-only mode
- Fix password search using the Kwallet backend
- Fix some crashes on macOS when switching application
- Fix 5.1/7.1 output on macOS and tvOS
- Fix several crashes and bugs in the macOS preferences panel
- Improvements on the threading of the MMDevice audio output on Windows
- Fix a potential security issue on the uninstaller DLLs
- Fix memory leaks when using the media_list_player libVLC APIs
- Translations:
- Update of most translations
- New translations to Esperanto, Interlingue, Lao, Macedonian, Burmese, Odia, Samoan and Swahili
Список пакетов
SUSE Package Hub 15 SP4
libvlc5-3.0.20-bp154.2.6.1
libvlccore9-3.0.20-bp154.2.6.1
vlc-3.0.20-bp154.2.6.1
vlc-codec-gstreamer-3.0.20-bp154.2.6.1
vlc-devel-3.0.20-bp154.2.6.1
vlc-jack-3.0.20-bp154.2.6.1
vlc-lang-3.0.20-bp154.2.6.1
vlc-noX-3.0.20-bp154.2.6.1
vlc-opencv-3.0.20-bp154.2.6.1
vlc-qt-3.0.20-bp154.2.6.1
vlc-vdpau-3.0.20-bp154.2.6.1
openSUSE Leap 15.4
libvlc5-3.0.20-bp154.2.6.1
libvlccore9-3.0.20-bp154.2.6.1
vlc-3.0.20-bp154.2.6.1
vlc-codec-gstreamer-3.0.20-bp154.2.6.1
vlc-devel-3.0.20-bp154.2.6.1
vlc-jack-3.0.20-bp154.2.6.1
vlc-lang-3.0.20-bp154.2.6.1
vlc-noX-3.0.20-bp154.2.6.1
vlc-opencv-3.0.20-bp154.2.6.1
vlc-qt-3.0.20-bp154.2.6.1
vlc-vdpau-3.0.20-bp154.2.6.1
Ссылки
- E-Mail link for openSUSE-SU-2023:0365-1
- SUSE Security Ratings
- SUSE CVE CVE-2022-37434 page
- SUSE CVE CVE-2023-5217 page
Описание
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).
Затронутые продукты
SUSE Package Hub 15 SP4:libvlc5-3.0.20-bp154.2.6.1
SUSE Package Hub 15 SP4:libvlccore9-3.0.20-bp154.2.6.1
SUSE Package Hub 15 SP4:vlc-3.0.20-bp154.2.6.1
SUSE Package Hub 15 SP4:vlc-codec-gstreamer-3.0.20-bp154.2.6.1
Ссылки
- CVE-2022-37434
- SUSE Bug 1202175
- SUSE Bug 1203030
- SUSE Bug 1205074
- SUSE Bug 1205289
- SUSE Bug 1216542
- SUSE Bug 1225671
Описание
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
SUSE Package Hub 15 SP4:libvlc5-3.0.20-bp154.2.6.1
SUSE Package Hub 15 SP4:libvlccore9-3.0.20-bp154.2.6.1
SUSE Package Hub 15 SP4:vlc-3.0.20-bp154.2.6.1
SUSE Package Hub 15 SP4:vlc-codec-gstreamer-3.0.20-bp154.2.6.1
Ссылки
- CVE-2023-5217
- SUSE Bug 1215776
- SUSE Bug 1215778
- SUSE Bug 1215814
- SUSE Bug 1217559