From f108d50df178e60eaa6f069ac7f85d1c9dc3dc65 Mon Sep 17 00:00:00 2001 From: Fabrice Fontaine Date: Tue, 28 Nov 2023 21:12:50 +0100 Subject: [PATCH] package/vlc: security bump to version 3.0.20 Fix CVE-2023-47359: Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a Heap-Based Buffer Overflow in function GetPacket() and results in a memory corruption. Fix CVE-2023-47360: Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length. https://code.videolan.org/videolan/vlc/-/blob/3.0.20/NEWS Signed-off-by: Fabrice Fontaine Signed-off-by: Peter Korsgaard (cherry picked from commit d675873f4fe9b601719b08cdd8a901d73ec7f731) Signed-off-by: Peter Korsgaard --- package/vlc/vlc.hash | 8 ++++---- package/vlc/vlc.mk | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package/vlc/vlc.hash b/package/vlc/vlc.hash index ef381e5934..40529bd664 100644 --- a/package/vlc/vlc.hash +++ b/package/vlc/vlc.hash @@ -1,7 +1,7 @@ -# From https://get.videolan.org/vlc/3.0.19/vlc-3.0.19.tar.xz.sha256 -sha256 643e3294bafe922324663ca499515b7564f2794575fd7d2b7992d20896381745 vlc-3.0.19.tar.xz -# From https://get.videolan.org/vlc/3.0.19/vlc-3.0.19.tar.xz.sha1 -sha1 6d162248a26fdd76a9d4e7e3d52f40d4326f72c1 vlc-3.0.19.tar.xz +# From https://get.videolan.org/vlc/3.0.20/vlc-3.0.20.tar.xz.sha256 +sha256 adc7285b4d2721cddf40eb5270cada2aaa10a334cb546fd55a06353447ba29b5 vlc-3.0.20.tar.xz +# From https://get.videolan.org/vlc/3.0.20/vlc-3.0.20.tar.xz.sha1 +sha1 b834516ab701bf6311980ed5d67b77c834fdebe7 vlc-3.0.20.tar.xz # Locally computed sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 COPYING sha256 dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551 COPYING.LIB diff --git a/package/vlc/vlc.mk b/package/vlc/vlc.mk index 729e928b4d..d0fc1744c0 100644 --- a/package/vlc/vlc.mk +++ b/package/vlc/vlc.mk @@ -4,7 +4,7 @@ # ################################################################################ -VLC_VERSION = 3.0.19 +VLC_VERSION = 3.0.20 VLC_SITE = https://get.videolan.org/vlc/$(VLC_VERSION) VLC_SOURCE = vlc-$(VLC_VERSION).tar.xz VLC_LICENSE = GPL-2.0+, LGPL-2.1+