Stories
Slash Boxes
Comments

SoylentNews is people

VLC: Vulnerability Not Found

posted by martyb on Thursday July 25 2019, @05:52PM   Printer-friendly
from the pics-or-it-didn't-happen dept.

takyon writes:

Alleged critical VLC flaw is nothing to worry about -- and is nothing to do with VLC

There has been a degree of confusion over the last few days after news spread of a supposed vulnerability in the media player VLC. Despite being labelled by security experts as "critical", VLC's developers, VideoLAN, denied there was a problem at all.

And they were right. While there is a vulnerability, it was in a third-party library, not VLC itself. On top of this, it is nowhere near as severe as first suggested. Oh -- and it was fixed over a year ago. An older version of Ubuntu Linux was to blame for the confusion.

The problem actually exists in a third-party library called libebml, and the issue was addressed some time ago. The upshot is that if you have updated VLC within the last year, there is no risk whatsoever. VLC's developers are understandably upset at the suggestion that their software was insecure.

Also at Tom's Hardware, Boing Boing, and The Register.

Original Submission

 
This discussion has been archived. No new comments can be posted.
VLC: Vulnerability Not Found | Log In/Create an Account | Top | 35 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 2) by c0lo on Friday July 26 2019, @05:16AM (3 children)

    by c0lo (156) Subscriber Badge on Friday July 26 2019, @05:16AM (#871337) Journal

    Wait... I know this one!
    Just rewrite VLC in JavaScript and execute it in browser. No static or dynamic linking, the app is always updated if newer than browser cache versions are found in the cloud. See? No problems.

    (large grin)

    --
    https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  
    Total Score:   2  

  • (Score: 2) by sshelton76 on Friday July 26 2019, @06:16AM (1 child)

    by sshelton76 (7978) on Friday July 26 2019, @06:16AM (#871351)

    I realize you're joking, but erm that's not just a joke it's a real project that exists...
    https://github.com/Phreshhh/PhreshPlayer [github.com]

    Works pretty well too!

    There's also this...
    https://www.radiantmediaplayer.com/ [radiantmediaplayer.com]

    And even a few articles on the subject...
    This one is my fav.
    https://blog.cinqmarsmedia.com/up-your-multitasking-game-how-i-built-a-transparent-video-player-app-with-electron-that-be2d5ba7f898 [cinqmarsmedia.com]

    • (Score: 3, Touché) by c0lo on Friday July 26 2019, @07:01AM

      by c0lo (156) Subscriber Badge on Friday July 26 2019, @07:01AM (#871358) Journal

      I realize you're joking,

      Only half joking.

      --
      https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford

  • (Score: 2) by DannyB on Friday July 26 2019, @01:46PM

    by DannyB (5839) Subscriber Badge on Friday July 26 2019, @01:46PM (#871456) Journal

    You realize the CLang compiler generates LLVM. There are projects [v8.dev] that compile LLVM to run in the browser.

    No need to rewrite VLC. Maybe. If they can get the runtime libraries to have GUI support for the browser.

    There was another project that ran an entire VM, which could boot a Linux, in the browser. But alas no GUI.

    --
    To transfer files: right-click on file, pick Copy. Unplug mouse, plug mouse into other computer. Right-click, paste.