From 7b27be82f1d39bef875eb12a660fb190b703b0f1 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Wed, 24 May 2017 23:13:17 +0200 Subject: [PATCH] package/vlc: security bump version to 2.2.6 Fixes CVE-2017-8312: Heap out-of-bound read in ParseJSS in VideoLAN VLC due to missing check of string length allows attackers to read heap uninitialized data via a crafted subtitles file. [Peter: add CVE info] Signed-off-by: Bernd Kuhls Signed-off-by: Thomas Petazzoni (cherry picked from commit b2f2f92887df5333772a9d0b75b5c4cb5675dd88) Signed-off-by: Peter Korsgaard --- package/vlc/vlc.hash | 8 ++------ package/vlc/vlc.mk | 2 +- 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/package/vlc/vlc.hash b/package/vlc/vlc.hash index 0f1b6dccd7..628dad74d9 100644 --- a/package/vlc/vlc.hash +++ b/package/vlc/vlc.hash @@ -1,6 +1,2 @@ -# From http://get.videolan.org/vlc/2.2.5.1/vlc-2.2.5.1.tar.xz.md5 -md5 7ab63964ffec4c92a54deb018f23318b vlc-2.2.5.1.tar.xz -# From http://get.videolan.org/vlc/2.2.5.1/vlc-2.2.5.1.tar.xz.sha1 -sha1 042962dba68e1414aa563883b0172ee121cf9555 vlc-2.2.5.1.tar.xz -# From http://get.videolan.org/vlc/2.2.5.1/vlc-2.2.5.1.tar.xz.sha256 -sha256 b28b8a28f578c0c6cb1ebed293aca2a3cd368906cf777d1ab599e2784ddda1cc vlc-2.2.5.1.tar.xz +# From http://download.videolan.org/pub/videolan/vlc/2.2.6/vlc-2.2.6.tar.xz.sha256 +sha256 c403d3accd9a400eb2181c958f3e7bc5524fe5738425f4253d42883b425a42a8 vlc-2.2.6.tar.xz diff --git a/package/vlc/vlc.mk b/package/vlc/vlc.mk index 3799acae86..49390a2856 100644 --- a/package/vlc/vlc.mk +++ b/package/vlc/vlc.mk @@ -4,7 +4,7 @@ # ################################################################################ -VLC_VERSION = 2.2.5.1 +VLC_VERSION = 2.2.6 VLC_SITE = http://get.videolan.org/vlc/$(VLC_VERSION) VLC_SOURCE = vlc-$(VLC_VERSION).tar.xz VLC_LICENSE = GPL-2.0+, LGPL-2.1+