Mageia alert MGASA-2020-0203 (vlc)

From:
             
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
             
 
updates-announce@ml.mageia.org 
Subject:
             
 
[updates-announce] MGASA-2020-0203: Updated vlc packages fix security vulnerabilities 
Date:
             
 
Fri, 8 May 2020 12:58:55 +0200
Message-ID:
             
 
<20200508105855.1238D9F641@duvel.mageia.org>
MGASA-2020-0203 - Updated vlc packages fix security vulnerabilities

Publication date: 08 May 2020
URL: https://advisories.mageia.org/MGASA-2020-0203.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2019-19721,
     CVE-2020-6071,
     CVE-2020-6072,
     CVE-2020-6073,
     CVE-2020-6077,
     CVE-2020-6078,
     CVE-2020-6079,
     CVE-2020-6080

Description:
Multiple security issues were discovered in the microdns plugin of the
VLC media player, which could result in denial of service or potentially
the execution of arbitrary code via malicious mDNS packets (CVE-2020-6071,
CVE-2020-6072, CVE-2020-6073, CVE-2020-6077, CVE-2020-6078, CVE-2020-6079,
CVE-2020-6080).

VLC has been updated to 3.0.10 to fix theese and other issues.

References:
- https://bugs.mageia.org/show_bug.cgi?id=26467
- https://www.videolan.org/security/sb-vlc309.html
- https://www.videolan.org/developers/vlc-branch/NEWS
- https://www.debian.org/security/2020/dsa-4671
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6071
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6072
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6073
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6077
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6078
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6079
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6080

SRPMS:
- 7/tainted/vlc-3.0.10-1.mga7.tainted
- 7/core/vlc-3.0.10-1.mga7