+++ This bug was initially created as a clone of Bug #15910 +++
An advisory has been issued today (May 11):
XBMC (Mageia 4) and Kodi (Mageia 5) still need to be patched for this issue.
kodi is fixed on SVN
xbmc is building
Patched packages uploaded for Mageia 4 and Cauldron. Thanks Nicolas!
Updated xbmc package fixes security vulnerability:
The dcraw tool suffers from an integer overflow condition which lead to a
buffer overflow. The vulnerability concerns the 'len' variable, parsed without
validation from opened images, used in the ljpeg_start() function. A
maliciously crafted raw image file can be used to trigger the vulnerability,
causing a Denial of Service condition (CVE-2015-3885).
The xbmc package contains a bundled copy of the affected code and has been
patched to fix this issue.
Updated packages in core/updates_testing:
kodi-14.0-1.mga5.src.rpm, xbmc-12.3-1.1.mga4.src.rpm =>
MGA5TOO, MGA4TOO =>
Created attachment 6548 [details]
MGA4-32 on AcerD620 Xfce
No installation issues
Plays commercial CD OK
try to play self created DVD, which plays OK on parole media player: as soon as entering TS_VIDEO, xfce bombs out
Gtk-Message: Failed to load module "canberra-gtk-module"
Running DIL (3.22.0) Version
DtsDeviceOpen: Opening HW in mode 0
DtsDeviceOpen: Create File Failed
libpng warning: iCCP: known incorrect sRGB profile
/usr/bin/xbmc: line 123: 11293 Segmentatiefout (core dumped) "$LIBDIR/xbmc/xbmc.bin" "$@"
Crash report available at /home/tester4/xbmc_crashlog-20150515_121925.log
Attachment 6548 mime type:
Is it a regression Herman? Mga4 has quite an old version now. I see reports of dvd issues elsewhere too for this version and other 12's
Tested same DVD with xbmc 12.3-1.1: same crash
I think you can add the OK then Herman please if you're happy with the rest of it.
I tried an mpg file, and that makes the new version crash as well (did not check anymore on 1.1), so there isn't much to be happy about. Pictures play OK.
Testing complete mga4 64
Fed it some avi and mkv and no regression noticed.
Please create a bug report for the DVD/mpg issues you found Herman, if you haven't already. Thanks.
Validating. Advisory uploaded.
Please push to 4 updates
MGA4-32-OK mga4-64-ok =>
advisory MGA4-32-OK mga4-64-okCC:
An update for this issue has been pushed to Mageia Updates repository.