4 ms·

Absolutely not: - the reporter never contacted us, we have a clear process and a bounty program. We checked again, he never did. - we receive and process all

by jbk 7y ago

Absolutely not: - the reporter never contacted us, we have a clear process and a bounty program. We checked again, he never did. - we receive and process all security issues privately: we fixed 31 of them in the last update. And miracly, the other reporters managed to contact us. - Linux is the smallest OS for VLC. - An issue on one or two Linux distribution for a OOB-read crash is very very different from "VLC vulnerable on all machines, uninstall now!" - The CVE number of 9.8 makes no sense. How do you even exploit this crash? - VLC has DEP and ASLR activated everywhere. How do you execute code with this read issue?

pgeorgi 7y ago
Since this is tarnishing your brand, maybe ask Ubuntu to cease shipping "VLC" if they do such a half-assed job (enough effort to replace integrated libraries with system packages, not enough effort to maintain those packages)?
- tgragnato 7y ago
  > maybe ask Ubuntu to cease shipping "VLC" I want applications to be packaged by my distribution. Updates are up to maintainers (dependencies included), as it has always been. If MITRE wants to assign a CVE, warning people that they need an updated lib, that's fine. The issue is the trustworthy and handling of CVEs (... plus reporters).
  - jakear 7y ago
    My impression is that VLC did issue an update to use a more recent version of libebml, but Ubuntu/Debian maintainers patched it to use universe’s outdated version (which they don’t even maintain!)
    - tgragnato 7y ago
      Yes! A glaring example of dependency hell (in Debian words "incompatible library changes with reverse dependencies"). Patching for an older version of libebml is not an issue if that library is not vulnerable (that's why folks use LTS and stable). Want maintainers to know there's a vulnerability? Publish a CVE _for libebml_.
fulafel 7y ago
By defensive I don't mean mean everyone else is right, just that there seem to remain a problem that should be addressed (warranting a CVE ID), even if there were hyped headlines in the press and an email communication problem. IMO it would be better PR to acknowledge the vulnerability and assume good faith on part of the reporter pending indications to the contrary. And maybe skip dismissing the Linux user base like this...

by jbk 7y ago

pgeorgi 7y ago

Since this is tarnishing your brand, maybe ask Ubuntu to cease shipping "VLC" if they do such a half-assed job (enough effort to replace integrated libraries with system packages, not enough effort to maintain those packages)?

tgragnato 7y ago
> maybe ask Ubuntu to cease shipping "VLC" I want applications to be packaged by my distribution. Updates are up to maintainers (dependencies included), as it has always been. If MITRE wants to assign a CVE, warning people that they need an updated lib, that's fine. The issue is the trustworthy and handling of CVEs (... plus reporters).
- jakear 7y ago
  My impression is that VLC did issue an update to use a more recent version of libebml, but Ubuntu/Debian maintainers patched it to use universe’s outdated version (which they don’t even maintain!)
  - tgragnato 7y ago
    Yes! A glaring example of dependency hell (in Debian words "incompatible library changes with reverse dependencies"). Patching for an older version of libebml is not an issue if that library is not vulnerable (that's why folks use LTS and stable). Want maintainers to know there's a vulnerability? Publish a CVE _for libebml_.

fulafel 7y ago

By defensive I don't mean mean everyone else is right, just that there seem to remain a problem that should be addressed (warranting a CVE ID), even if there were hyped headlines in the press and an email communication problem. IMO it would be better PR to acknowledge the vulnerability and assume good faith on part of the reporter pending indications to the contrary. And maybe skip dismissing the Linux user base like this...