VLC 3.0.12.1 has been released on December 16: https://git.videolan.org/?p=vlc/vlc-3.0.git;a=blob;f=NEWS;h=fa96b26d27516e6ee16a1781a380f2754b2d474d;hb=170157402b9c9ee5651838499549328c6715b5fe It lists security improvements in the web interface among the changes. The tarball doesn't seem to be available, but alt-linux has picked up the update.
Whiteboard: (none) => MGA7TOO
VLC is nursed by different people, so assigning this globally.
Summary: VLC 3.0.12.1 => VLC 3.0.12.1 includes security improvements in the web interfaceSource RPM: vlc-3.0.11.1-1.mga7.src.rpm => vlc-3.0.11.1-6.mga8.src.rpm, vlc-3.0.11.1-1.mga7.src.rpmAssignee: bugsquad => pkg-bugs
fixed in cauldron
Version: Cauldron => 7CC: (none) => mageiaWhiteboard: MGA7TOO => (none)
pushed in core and tainted: src: vlc-3.0.12.1-1.mga7
Assignee: pkg-bugs => qa-bugs
Note that there are core and tainted builds. Advisory: ======================== Updated vlc packages features security improvements: The vlc package has been updated to version 3.0.12.1, which includes security enhancements in the web interface, as well as other fixes and enhancements. See the upstream NEWS file for details. References: https://git.videolan.org/?p=vlc/vlc-3.0.git;a=blob;f=NEWS;h=fa96b26d27516e6ee16a1781a380f2754b2d474d;hb=170157402b9c9ee5651838499549328c6715b5fe ======================== Updated packages in {core,tainted}/updates_testing: ======================== vlc-3.0.12.1-1.mga7 libvlc5-3.0.12.1-1.mga7 libvlccore9-3.0.12.1-1.mga7 libvlc-devel-3.0.12.1-1.mga7 vlc-plugin-common-3.0.12.1-1.mga7 vlc-plugin-zvbi-3.0.12.1-1.mga7 vlc-plugin-kate-3.0.12.1-1.mga7 vlc-plugin-libass-3.0.12.1-1.mga7 vlc-plugin-lua-3.0.12.1-1.mga7 vlc-plugin-ncurses-3.0.12.1-1.mga7 vlc-plugin-lirc-3.0.12.1-1.mga7 svlc-3.0.12.1-1.mga7 vlc-plugin-aa-3.0.12.1-1.mga7 vlc-plugin-sdl-3.0.12.1-1.mga7 vlc-plugin-shout-3.0.12.1-1.mga7 vlc-plugin-opengl-3.0.12.1-1.mga7 vlc-plugin-vdpau-3.0.12.1-1.mga7 vlc-plugin-projectm-3.0.12.1-1.mga7 vlc-plugin-theora-3.0.12.1-1.mga7 vlc-plugin-twolame-3.0.12.1-1.mga7 vlc-plugin-fluidsynth-3.0.12.1-1.mga7 vlc-plugin-gme-3.0.12.1-1.mga7 vlc-plugin-schroedinger-3.0.12.1-1.mga7 vlc-plugin-speex-3.0.12.1-1.mga7 vlc-plugin-flac-3.0.12.1-1.mga7 vlc-plugin-dv-3.0.12.1-1.mga7 vlc-plugin-mod-3.0.12.1-1.mga7 vlc-plugin-mpc-3.0.12.1-1.mga7 vlc-plugin-sid-3.0.12.1-1.mga7 vlc-plugin-sndio-3.0.12.1-1.mga7 vlc-plugin-pulse-3.0.12.1-1.mga7 vlc-plugin-jack-3.0.12.1-1.mga7 vlc-plugin-rist-3.0.12.1-1.mga7 vlc-plugin-upnp-3.0.12.1-1.mga7 vlc-plugin-gnutls-3.0.12.1-1.mga7 vlc-plugin-libnotify-3.0.12.1-1.mga7 vlc-plugin-chromaprint-3.0.12.1-1.mga7 vlc-plugin-samba-3.0.12.1-1.mga7 from vlc-3.0.12.1-1.mga7.src.rpm
mga7, x86_64 Reverted to core release versions of all the packages, made a few quick checks then updated everything in the list. Ran a series of simple checks on files with various video and audio formats. Everything worked, including subtitles on videos where available. Played Youtube video via network stream facility. Home DVD recordings from TV or VCR played fine. Commercial audio CDs OK. Played a commercial cinema DVD. svlc works as well - found my preferred theme. So far so good for the free version.
CC: (none) => tarazed25
Continuing from comment 5: Removed all trace of vlc from the system then reinstalled the tainted version. Checked that then updated all the packages from tainted and executed all the tests already carried out albeit with different files occasionally. Tested AIFF, AVI, DIVX, FLV, MP3, MP4, MPV, MKV, TS, MOV, OGG, FLAC, WAV, WMV, WEBM. Shockwave Flash is not accepted. Youtube videos via network stream, hardware audio CD and DVD. svlc for themes. Ready for use.
Whiteboard: (none) => MGA7-64-OK
Good, both core and tainted builds were tested. Validating. Advisory in Comment 4.
Keywords: (none) => validated_updateCC: (none) => andrewsfarm, sysadmin-bugs
CC: (none) => ouaurelienSource RPM: vlc-3.0.11.1-6.mga8.src.rpm, vlc-3.0.11.1-1.mga7.src.rpm => vlc-3.0.11.1-1.mga7.src.rpmKeywords: (none) => advisory
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2021-0005.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED
This update also fixed CVE-2020-26664 (fixed in 3.0.12): https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OD6C4CTIQTZF237437FPGD5AIRV33TET/
This update also fixed CVE-2021-2580[1-4] (fixed in 3.0.12): https://www.debian.org/lts/security/2021/dla-2728