[Solved] VLC 3.0.3 detected as safe

Anselm · 5 Dec 2018, 11:07

FYI:
Common Vulnerabilities and Exposures (CVE):

Tom · 5 Dec 2018, 13:11

Thank you.

Yeah, well, as we discussed that, it seems that a guy has found a vuln in 3.0.4.

So it is time to flag all versions as being "Insecure"

Let's hope a new release of VLC comes out one of the next days.

CVE Details is a great site for getting some high level information about the history of a product.

However, CVE itself, has seen better days, unfortunately a lot of vulns are assigned CVEs rather late and a lot never receives a CVE.

Just look at yesterdays Chrome release, where some of the vulns are "To be allocated [a CVE]". That seems odd for such a significant app as Chrome:
https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html

OLLI_S · 5 Dec 2018, 19:58

Tom, is the issue solved (after you flagged all versions as being "Insecure")?

Anselm · 5 Dec 2018, 20:31

@Tom says, 3.0.2, 3.0.3, 3.0.4 are not insecure, but 3.0.4 is recommended . I only found an information, that 3.0.1 is insecure.

Tom · 6 Dec 2018, 08:48

Anselm · 6 Dec 2018, 08:51

@Tom OK, i did not see it at cve.mitre.org using the search.

Anselm · 6 Dec 2018, 09:30

@Anselm Correction: OK, i did not see it yesterday at cve.mitre.org using the search. But now i knew why:
Date Entry Created
20181205

Tom · 28 Dec 2018, 14:57

@Anselm VLC 3.0.5 is out

Anselm · 28 Dec 2018, 16:00

@Tom Thank you, I updated it yesterday

GregAlexandre · 29 Dec 2018, 17:51

@Tom
From changelog 3.0.4 to 3.0.5
"Update numerous 3rd party libraries, including for minor security issues"

This subject could be close.

Thanks a lot Tom.

OLLI_S · 30 Dec 2018, 09:50

@GregAlexandre OK, then I mark the topic as Solved