2 ms·
That's fair; the article is probably taking its information from the CVE and the links to Symantec's "Security Focus" where apparently the research claims to ha
by deathanatos 7y ago
That's fair; the article is probably taking its information from the CVE and the links to Symantec's "Security Focus" where apparently the research claims to have prepared an exploit. The bug itself (which perhaps is all the VLC people are looking at, aside from the news, now?) is pretty bare bones.
I too have no idea where Gizmodo is getting the notion that it is being worked on. Perhaps they're getting that from the failed reproduction attempts.
- dvtrn 7y agoJudging from the statement: VideoLAN is also aware of the issue and is currently working on a patch, though right now I'm going to guess someone quickly glanced at the issue tracker, saw a percentage of work done and presumed "vulnerability: valid" and pressed on with publication without bothering to try reaching JBK for comment. Both sites really ought to update their posts for clarity. Terrible form, IMO --in the interest of security disclosures. VideoLAN does not seem amused about it either: https://twitter.com/videolan/status/1153715138333220864 https://twitter.com/videolan/status/1153715138333220864
- av3csr 7y agoThey probably read the third comment, Component: Demuxers → Demuxers: MKV Work status: 60% → Not started