Bug 17724 - VLC 2.2.2
Summary: VLC 2.2.2
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/677984/
Whiteboard: has_procedure advisory MGA5-32-OK MGA...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2016-02-09 23:53 CET by David Walser
Modified: 2016-03-01 02:15 CET (History)
6 users (show)

See Also:
Source RPM: vlc-2.2.1-1.1.mga5.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2016-02-09 23:53:51 CET
VLC 2.2.2 has been released on February 6, with several security-related fixes:
http://www.videolan.org/developers/vlc-branch/NEWS

The update is checked into Mageia 5 SVN, but currently can't be built because of a problem with libsmbclient (likely caused by the samba4 updates in updates_testing).

Reproducible: 

Steps to Reproduce:
Comment 1 David Walser 2016-02-25 03:58:43 CET
Updated package uploaded for Mageia 5.

Note that there are both core and tainted builds for this package.

Advisory:
========================

Updated vlc packages fix security vulnerabilities:

The vlc package has been updated to version 2.2.2, which fixes several bugs
and possible security issues.  See the NEWS file for details.

References:
http://git.videolan.org/?p=vlc/vlc-2.2.git;a=blob;f=NEWS;h=e6521fa76e76ae3dc58be58d73cfadb528cc10a2;hb=6259d80d343c4307b29603b2d88c081c57d68564
========================

Updated packages in {core,tainted}/updates_testing:
========================
vlc-2.2.2-1.mga5
libvlc5-2.2.2-1.mga5
libvlccore8-2.2.2-1.mga5
libvlc-devel-2.2.2-1.mga5
vlc-plugin-common-2.2.2-1.mga5
vlc-plugin-zvbi-2.2.2-1.mga5
vlc-plugin-kate-2.2.2-1.mga5
vlc-plugin-libass-2.2.2-1.mga5
vlc-plugin-lua-2.2.2-1.mga5
vlc-plugin-ncurses-2.2.2-1.mga5
vlc-plugin-lirc-2.2.2-1.mga5
svlc-2.2.2-1.mga5
vlc-plugin-aa-2.2.2-1.mga5
vlc-plugin-sdl-2.2.2-1.mga5
vlc-plugin-shout-2.2.2-1.mga5
vlc-plugin-opengl-2.2.2-1.mga5
vlc-plugin-vdpau-2.2.2-1.mga5
vlc-plugin-projectm-2.2.2-1.mga5
vlc-plugin-theora-2.2.2-1.mga5
vlc-plugin-twolame-2.2.2-1.mga5
vlc-plugin-fluidsynth-2.2.2-1.mga5
vlc-plugin-gme-2.2.2-1.mga5
vlc-plugin-schroedinger-2.2.2-1.mga5
vlc-plugin-speex-2.2.2-1.mga5
vlc-plugin-flac-2.2.2-1.mga5
vlc-plugin-dv-2.2.2-1.mga5
vlc-plugin-mod-2.2.2-1.mga5
vlc-plugin-mpc-2.2.2-1.mga5
vlc-plugin-sid-2.2.2-1.mga5
vlc-plugin-pulse-2.2.2-1.mga5
vlc-plugin-jack-2.2.2-1.mga5
vlc-plugin-bonjour-2.2.2-1.mga5
vlc-plugin-upnp-2.2.2-1.mga5
vlc-plugin-gnutls-2.2.2-1.mga5
vlc-plugin-libnotify-2.2.2-1.mga5
vlc-plugin-chromaprint-2.2.2-1.mga5

from vlc-2.2.2-1.mga5.src.rpm

Assignee: mageia => qa-bugs

Comment 2 Ben McMonagle 2016-02-25 09:57:54 CET
installed: 
  vlc                            2.2.2        1.mga5        i586    
  vlc-plugin-flac                2.2.2        1.mga5        i586    
  vlc-plugin-speex               2.2.2        1.mga5        i586    
  vlc-plugin-theora              2.2.2        1.mga5        i586    

*.mp4:
playback sound / video ok
issue changing from zoom 1:1 => 2:1 => 2:1 [approx 1.5:1]

*.avi:
playback ok - aspect ratios options work ok
issue while converting to *.mp4- no video in monitor window even tho' check box ticked- only first frame, but monitor sound ok

*mp3 playback ok

CC: (none) => westel

Comment 3 claire robinson 2016-02-25 10:13:48 CET
Advisory uploaded, with tainted srpm added.

Whiteboard: (none) => has_procedure advisory

Comment 4 claire robinson 2016-02-25 10:14:19 CET
Please try with tainted update also Ben.
Comment 5 Len Lawrence 2016-02-25 10:38:02 CET
mga5  x86_64  Mate

Started off with a tainted installation - my default.

Installed all the extra plugins before the update and checked various formats to make sure that they all worked:
mp3, mp4 and other mpeg variations, mp4 with srt (subtitles), Youtube videos,
flv, flac, ogg, wmv, wav and mkv (Matroska).  A couple of WAV files failed with "could not peek" errors, whatever that may mean.  No avi files on this machine.  TV streaming from an aerial worked fine, with subtitles also.  The aspect ratio on an old scifi film needed adjusting; that worked.  At this stage I do not know what most of the plugins do so cannot think how to test them; need to do some research.

The update test will have to be split into two stages, Updates and Tainted Updates.  Later.

CC: (none) => tarazed25

Comment 6 Len Lawrence 2016-02-25 11:53:44 CET
Core updates testing, 64bit architecture.

These formats all work:
mp4
m2t
ts
mp4 + srt (subtitle track)
mkv
ogg
wav
wmv
dvd
TV stream + record and playback, some with subtitles
mp3
flac
Youtube music videos (flv, mp4)

And these operations all function:
fullscreen resizing and Esc to revert
Skin browser
Changing aspect ratio
Comment 7 Len Lawrence 2016-02-25 12:40:12 CET
Updated to the tainted versions for all packages.

No changes in behaviour noted since the last set of tests.
The commonly used interface controls work as expected.
All audio and video formats work, TV streaming, recording and playback.
Just discovered that vlc can also deal with homespun m3u playlists including skipping to the next or previous tracks.  Untested in previous runs.

Video snapshots do not work, nor did they for Core Updates Testing.  This is puzzling because as far as I can remember snapshots used to work.
Typical error output is:
[00007f87e44934b8] vdpau_chroma filter error: corrupt VDPAU video surface 0x7f877800cf10
[00007f87902d8e38] core video output error: Failed to convert image for snapshot
Comment 8 Len Lawrence 2016-02-25 17:07:10 CET
I have just tried the Tainted vlc on another machine, no update, and that was able to take snapshots, ~/Pictures/vlcsnap*.png.  Could be a regression.
Comment 9 Len Lawrence 2016-02-25 17:20:49 CET
$ sudo urpme vlc-plugin-vdpau

That fixed the snapshot problem.  The function works again.

Does that need a separate bug report?  Anybody care to run their own tests on this one?
Comment 10 claire robinson 2016-02-25 17:23:33 CET
Is that a regression with the update or just something not working in the current version? Does the update fix it if so?
Comment 11 Len Lawrence 2016-02-25 18:21:41 CET
The current version works for snapshots but I have never tried installing the vdpau plugin.  Perhaps that needs to be done first.  The update works also, without the vdpau plugin so it looks like the plugin is faulty.

If it is available for the current version I shall try installing the plugin on the other machine and report back.
Comment 12 Len Lawrence 2016-02-25 18:30:06 CET
Thanks Claire for the poke.  Yes, the plugin prevents the taking of snapshots with the current version, 2.2.1, also so it is not a regression but a continuing fault.  That probably means that we can OK the 64bit vlc.  And I should file a bug against the vdpau plugin.
Comment 13 William Kenney 2016-02-25 20:23:55 CET
In VirtualBox, M5, KDE, 32-bit

Package(s) under test:
vlc svlc vlc-plugin-upnp libvlc5 libvlccore8 vlc-plugin-common
vlc-plugin-pulse vlc-plugin-theora

default install of vlc svlc vlc-plugin-upnp libvlc5 libvlccore8
vlc-plugin-common vlc-plugin-pulse & vlc-plugin-theora

[root@localhost wilcal]# urpmi vlc
Package vlc-2.2.1-1.1.mga5.tainted.i586 is already installed
[root@localhost wilcal]# urpmi svlc
Package svlc-2.2.1-1.1.mga5.tainted.i586 is already installed
[root@localhost wilcal]# urpmi vlc-plugin-upnp
Package vlc-plugin-upnp-2.2.1-1.1.mga5.tainted.i586 is already installed
[root@localhost wilcal]# urpmi libvlc5
Package libvlc5-2.2.1-1.1.mga5.tainted.i586 is already installed
[root@localhost wilcal]# urpmi libvlccore8
Package libvlccore8-2.2.1-1.1.mga5.tainted.i586 is already installed
[root@localhost wilcal]# urpmi vlc-plugin-common
Package vlc-plugin-common-2.2.1-1.1.mga5.tainted.i586 is already installed
[root@localhost wilcal]# urpmi vlc-plugin-pulse
Package vlc-plugin-pulse-2.2.1-1.1.mga5.tainted.i586 is already installed
[root@localhost wilcal]# urpmi vlc-plugin-theora
Package vlc-plugin-theora-2.2.1-1.1.mga5.tainted.i586 is already installed

VLC plays files: mov mp4 dvd flv wmv wav mp3 webm ogg ogv

install vlc svlc vlc-plugin-upnp libvlc5 libvlccore8 vlc-plugin-common
vlc-plugin-pulse & vlc-plugin-theora from updates_testing

[root@localhost wilcal]# urpmi vlc
Package vlc-2.2.2-1.mga5.tainted.i586 is already installed
[root@localhost wilcal]# urpmi svlc
Package svlc-2.2.2-1.mga5.tainted.i586 is already installed
[root@localhost wilcal]# urpmi vlc-plugin-upnp
Package vlc-plugin-upnp-2.2.2-1.mga5.tainted.i586 is already installed
[root@localhost wilcal]# urpmi libvlc5
Package libvlc5-2.2.2-1.mga5.tainted.i586 is already installed
[root@localhost wilcal]# urpmi libvlccore8
Package libvlccore8-2.2.2-1.mga5.tainted.i586 is already installed
[root@localhost wilcal]# urpmi vlc-plugin-common
Package vlc-plugin-common-2.2.2-1.mga5.tainted.i586 is already installed
[root@localhost wilcal]# urpmi vlc-plugin-pulse
Package vlc-plugin-pulse-2.2.2-1.mga5.tainted.i586 is already installed
[root@localhost wilcal]# urpmi vlc-plugin-theora
Package vlc-plugin-theora-2.2.2-1.mga5.tainted.i586 is already installed

Package works

VLC plays files: mov mp4 dvd flv wmv wav mp3 webm ogg ogv

CC: (none) => wilcal.int

Comment 14 William Kenney 2016-02-25 22:58:28 CET
In VirtualBox, M5, KDE, 64-bit

Package(s) under test:
vlc svlc vlc-plugin-upnp lib64vlc5 lib64vlccore8 vlc-plugin-common
vlc-plugin-pulse vlc-plugin-theora

default install of vlc svlc vlc-plugin-upnp lib64vlc5 lib64vlccore8
vlc-plugin-common vlc-plugin-pulse & vlc-plugin-theora

[root@localhost wilcal]# urpmi vlc
Package vlc-2.2.1-1.1.mga5.tainted.x86_64 is already installed
[root@localhost wilcal]# urpmi svlc
Package svlc-2.2.1-1.1.mga5.tainted.x86_64 is already installed
[root@localhost wilcal]# urpmi vlc-plugin-upnp
Package vlc-plugin-upnp-2.2.1-1.1.mga5.tainted.x86_64 is already installed
[root@localhost wilcal]# urpmi lib64vlc5
Package lib64vlc5-2.2.1-1.1.mga5.tainted.x86_64 is already installed
[root@localhost wilcal]# urpmi lib64vlccore8
Package lib64vlccore8-2.2.1-1.1.mga5.tainted.x86_64 is already installed
[root@localhost wilcal]# urpmi vlc-plugin-common
Package vlc-plugin-common-2.2.1-1.1.mga5.tainted.x86_64 is already installed
[root@localhost wilcal]# urpmi vlc-plugin-pulse
Package vlc-plugin-pulse-2.2.1-1.1.mga5.tainted.x86_64 is already installed
[root@localhost wilcal]# urpmi vlc-plugin-theora
Package vlc-plugin-theora-2.2.1-1.1.mga5.tainted.x86_64 is already installed

VLC plays files: mov mp4 dvd flv wmv wav mp3 webm ogg ogv

install vlc svlc vlc-plugin-upnp libvlc5 libvlccore8 vlc-plugin-common
vlc-plugin-pulse & vlc-plugin-theora from updates_testing

[root@localhost wilcal]# urpmi vlc
Package vlc-2.2.2-1.mga5.tainted.x86_64 is already installed
[root@localhost wilcal]# urpmi svlc
Package svlc-2.2.2-1.mga5.tainted.x86_64 is already installed
[root@localhost wilcal]# urpmi vlc-plugin-upnp
Package vlc-plugin-upnp-2.2.2-1.mga5.tainted.x86_64 is already installed
[root@localhost wilcal]# urpmi libvlc5
Package libvlc5-2.2.2-1.mga5.i586 is already installed
[root@localhost wilcal]# urpmi libvlccore8
Package libvlccore8-2.2.2-1.mga5.i586 is already installed
[root@localhost wilcal]# urpmi vlc-plugin-common
Package vlc-plugin-common-2.2.2-1.mga5.tainted.x86_64 is already installed
[root@localhost wilcal]# urpmi vlc-plugin-pulse
Package vlc-plugin-pulse-2.2.2-1.mga5.tainted.x86_64 is already installed
[root@localhost wilcal]# urpmi vlc-plugin-theora
Package vlc-plugin-theora-2.2.2-1.mga5.tainted.x86_64 is already installed

VLC plays files: mov mp4 dvd flv wmv wav mp3 webm ogg ogv
Comment 15 Thomas Andrews 2016-02-26 00:14:53 CET
Installed tainted versions in MGA5 in 32-bit and 64-bit VirtualBox, 32-bit and 64-bit Dell desktop with older Intel graphics, and 64-bit with nVidia graphics. 

Successfully played mov, mp4, mkv, and avi videos. Slight choppiness noted in one video with VirtualBox, but I believe that was a speed issue with reading and playing from a usb 2.0 external hard drive. No other problems noted.

CC: (none) => andrewsfarm

Comment 16 William Kenney 2016-02-26 00:37:00 CET
Thanks Thomas. Lets push this one along.
This update works fine.
Testing complete for MGA5, 32-bit & 64-bit
Validating the update.
Could someone from the sysadmin team push to updates.
Thanks

Keywords: (none) => validated_update
Whiteboard: has_procedure advisory => has_procedure advisory MGA5-32-OK MGA5-64-OK
CC: (none) => sysadmin-bugs

Comment 17 Mageia Robot 2016-02-26 22:46:35 CET
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2016-0083.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 18 Frédéric "LpSolit" Buclin 2016-02-27 14:49:01 CET
VLC 2.2.2 fails badly if you select a removed file from the "recent media" menu. It tries to open the error window, but fails to do so, and there is no way to close VLC. You are force to use kill -9 to stop it.

CC: (none) => LpSolit

Comment 19 Thomas Andrews 2016-02-27 15:51:24 CET
(In reply to Frédéric Buclin from comment #18)
> VLC 2.2.2 fails badly if you select a removed file from the "recent media"
> menu. It tries to open the error window, but fails to do so, and there is no
> way to close VLC. You are force to use kill -9 to stop it.

Are you seeing this with the core version, or the tainted version?

I just tried the tainted version on both 32-bit and 64-bit systems, and I don't see the behavior. I get the error message on both, after which I can close the error window and go on.
Comment 20 Frédéric "LpSolit" Buclin 2016-02-27 18:59:21 CET
(In reply to Thomas Andrews from comment #19)
> Are you seeing this with the core version, or the tainted version?

Tainted one. 32bit.
Comment 21 claire robinson 2016-02-27 19:27:25 CET
Please create a new bug report, this one has now been pushed.
Comment 22 Thomas Andrews 2016-02-27 19:33:02 CET
Hmm. Mine works flawlessly. I wonder how our systems differ.

I think you should open a new bug report on this. Since this particular bug has been labeled as "Resolved" and "Fixed," it might not receive the same kind of attention a new bug would see.

Please provide details about your system and hardware, so the Bug Squad can attempt to replicate the problem.
David Walser 2016-03-01 00:10:57 CET

URL: (none) => http://lwn.net/Vulnerabilities/677984/

Comment 23 Frédéric "LpSolit" Buclin 2016-03-01 01:06:56 CET
(In reply to Thomas Andrews from comment #19)
> I just tried the tainted version on both 32-bit and 64-bit systems, and I
> don't see the behavior. I get the error message on both, after which I can
> close the error window and go on.

Before I file a new bug, could you check that you have the "repeat playlist" (or maybe "playlist loop"; I don't know the name of the button in english) feature enabled? In that case, VLC fails to open the file, then tries to play the next song in the playlist, which is the same inexistent file, and so generates tons of errors in a loop. Of course, your playlist must be empty before you select this file, else it will start playing the next song.
Comment 24 Thomas Andrews 2016-03-01 02:15:16 CET
I believe I found the setting you're asking about, and I did set it. If the play list is empty, "Open Recent Media" is grayed out and non-functional. A video file will play, which of course puts it on the playlist, making it no longer empty, so I can't seem to replicate the problem.

Be aware that I don't play audio files with VLC, only videos.

Please, I urge you to open a new bug report.

Note You need to log in before you can comment on or make changes to this bug.