<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for vlc</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>openSUSE-SU-2022:10252-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2022-12-27T09:00:21Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2022-12-27T09:00:21Z</InitialReleaseDate>
    <CurrentReleaseDate>2022-12-27T09:00:21Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for vlc</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for vlc fixes the following issues:

- Update to version 3.0.18 (CVE-2022-41325, boo#1206142):
  + macOS: Fix audio device listing with non-latin names.
  + Misc: Fix rendering and performance issue with older GPUs.
  + Updated translations.
- Changes from version 3.0.18-rc2:
  + Codec/Demux:
    - Add support for Y16 chroma.
    - Fix build of gme plugin.
  + Lua:
    - Fix script for vocaroo.
    - Fix script for youtube to allow throttled playback.
  + Service Discovery: Fix UPnP regression on Windows.
  + Video Output: Fix video placement with caopengllayer.
  + Misc: Fix password search in kwallet module.
- Changes from version 3.0.18-rc:
  + Demux:
    - Major adaptive streaming update, notably for multiple
      timelies and webvtt.
    - Fix seeking with some fragmented MP4 files.
    - Add support for DVBSub inside MKV.
    - Fix some Flac files that could not be played.
    - Improve seeking in Ogg files.
  + Decoders:
    - Fix DxVA/D3D11 crashes on HEVC files with bogus references.
    - Fix libass storage size and crash.
    - Fix decoding errors on macOS hw decoding on some HEVC files.
  + Video Output:
    - Fix color regression with VAAPI/iOS and OpenGL output.
    - Fix some resizing issues with OpenGL on GLX/EGL/X11/XV.
    - Fix Direct3d9 texture stretching.
    - Fix 10-bit accelerated video filters on macOS.
  + Playlist: Avoid playlist liveloop on failed/tiny items
    (temporize EOS bursts).
  + Misc:
    - Misc fixes for the extension UI on macOS.
    - Improve SMBv1 and SMBv2 behaviours.
    - Improve FTP compatibility.
    - Support RISC-V.
    - Fix AVI muxing for Windows Media Player compatibility.
    - Fix seeking speed on macOS.
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">openSUSE-2022-10252</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YI4EVQJJHK52U3OVX236TQ775IVEFDQS/</URL>
      <Description>E-Mail link for openSUSE-SU-2022:10252-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1200944</URL>
      <Description>SUSE Bug 1200944</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1206142</URL>
      <Description>SUSE Bug 1206142</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-0499/</URL>
      <Description>SUSE CVE CVE-2020-0499 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2021-0561/</URL>
      <Description>SUSE CVE CVE-2021-0561 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-41325/</URL>
      <Description>SUSE CVE CVE-2022-41325 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Package Hub 15 SP3">
      <Branch Type="Product Name" Name="SUSE Package Hub 15 SP3">
        <FullProductName ProductID="SUSE Package Hub 15 SP3">SUSE Package Hub 15 SP3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="openSUSE Leap 15.3">
      <Branch Type="Product Name" Name="openSUSE Leap 15.3">
        <FullProductName ProductID="openSUSE Leap 15.3" CPE="cpe:/o:opensuse:leap:15.3">openSUSE Leap 15.3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="libvlc5-3.0.18-bp153.2.6.1">
      <FullProductName ProductID="libvlc5-3.0.18-bp153.2.6.1">libvlc5-3.0.18-bp153.2.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libvlccore9-3.0.18-bp153.2.6.1">
      <FullProductName ProductID="libvlccore9-3.0.18-bp153.2.6.1">libvlccore9-3.0.18-bp153.2.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="vlc-3.0.18-bp153.2.6.1">
      <FullProductName ProductID="vlc-3.0.18-bp153.2.6.1">vlc-3.0.18-bp153.2.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="vlc-codec-gstreamer-3.0.18-bp153.2.6.1">
      <FullProductName ProductID="vlc-codec-gstreamer-3.0.18-bp153.2.6.1">vlc-codec-gstreamer-3.0.18-bp153.2.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="vlc-devel-3.0.18-bp153.2.6.1">
      <FullProductName ProductID="vlc-devel-3.0.18-bp153.2.6.1">vlc-devel-3.0.18-bp153.2.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="vlc-jack-3.0.18-bp153.2.6.1">
      <FullProductName ProductID="vlc-jack-3.0.18-bp153.2.6.1">vlc-jack-3.0.18-bp153.2.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="vlc-lang-3.0.18-bp153.2.6.1">
      <FullProductName ProductID="vlc-lang-3.0.18-bp153.2.6.1">vlc-lang-3.0.18-bp153.2.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="vlc-noX-3.0.18-bp153.2.6.1">
      <FullProductName ProductID="vlc-noX-3.0.18-bp153.2.6.1">vlc-noX-3.0.18-bp153.2.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="vlc-opencv-3.0.18-bp153.2.6.1">
      <FullProductName ProductID="vlc-opencv-3.0.18-bp153.2.6.1">vlc-opencv-3.0.18-bp153.2.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="vlc-qt-3.0.18-bp153.2.6.1">
      <FullProductName ProductID="vlc-qt-3.0.18-bp153.2.6.1">vlc-qt-3.0.18-bp153.2.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="vlc-vdpau-3.0.18-bp153.2.6.1">
      <FullProductName ProductID="vlc-vdpau-3.0.18-bp153.2.6.1">vlc-vdpau-3.0.18-bp153.2.6.1</FullProductName>
    </Branch>
    <Relationship ProductReference="libvlc5-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:libvlc5-3.0.18-bp153.2.6.1">libvlc5-3.0.18-bp153.2.6.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libvlccore9-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:libvlccore9-3.0.18-bp153.2.6.1">libvlccore9-3.0.18-bp153.2.6.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="vlc-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:vlc-3.0.18-bp153.2.6.1">vlc-3.0.18-bp153.2.6.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="vlc-codec-gstreamer-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:vlc-codec-gstreamer-3.0.18-bp153.2.6.1">vlc-codec-gstreamer-3.0.18-bp153.2.6.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="vlc-devel-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:vlc-devel-3.0.18-bp153.2.6.1">vlc-devel-3.0.18-bp153.2.6.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="vlc-jack-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:vlc-jack-3.0.18-bp153.2.6.1">vlc-jack-3.0.18-bp153.2.6.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="vlc-lang-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:vlc-lang-3.0.18-bp153.2.6.1">vlc-lang-3.0.18-bp153.2.6.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="vlc-noX-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:vlc-noX-3.0.18-bp153.2.6.1">vlc-noX-3.0.18-bp153.2.6.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="vlc-opencv-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:vlc-opencv-3.0.18-bp153.2.6.1">vlc-opencv-3.0.18-bp153.2.6.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="vlc-qt-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:vlc-qt-3.0.18-bp153.2.6.1">vlc-qt-3.0.18-bp153.2.6.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="vlc-vdpau-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:vlc-vdpau-3.0.18-bp153.2.6.1">vlc-vdpau-3.0.18-bp153.2.6.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libvlc5-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:libvlc5-3.0.18-bp153.2.6.1">libvlc5-3.0.18-bp153.2.6.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libvlccore9-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:libvlccore9-3.0.18-bp153.2.6.1">libvlccore9-3.0.18-bp153.2.6.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="vlc-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:vlc-3.0.18-bp153.2.6.1">vlc-3.0.18-bp153.2.6.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="vlc-codec-gstreamer-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:vlc-codec-gstreamer-3.0.18-bp153.2.6.1">vlc-codec-gstreamer-3.0.18-bp153.2.6.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="vlc-devel-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:vlc-devel-3.0.18-bp153.2.6.1">vlc-devel-3.0.18-bp153.2.6.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="vlc-jack-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:vlc-jack-3.0.18-bp153.2.6.1">vlc-jack-3.0.18-bp153.2.6.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="vlc-lang-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:vlc-lang-3.0.18-bp153.2.6.1">vlc-lang-3.0.18-bp153.2.6.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="vlc-noX-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:vlc-noX-3.0.18-bp153.2.6.1">vlc-noX-3.0.18-bp153.2.6.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="vlc-opencv-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:vlc-opencv-3.0.18-bp153.2.6.1">vlc-opencv-3.0.18-bp153.2.6.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="vlc-qt-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:vlc-qt-3.0.18-bp153.2.6.1">vlc-qt-3.0.18-bp153.2.6.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="vlc-vdpau-3.0.18-bp153.2.6.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:vlc-vdpau-3.0.18-bp153.2.6.1">vlc-vdpau-3.0.18-bp153.2.6.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156076070</Note>
    </Notes>
    <CVE>CVE-2020-0499</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Package Hub 15 SP3:libvlc5-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:libvlccore9-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-codec-gstreamer-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-devel-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-jack-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-lang-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-noX-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-opencv-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-qt-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-vdpau-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:libvlc5-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:libvlccore9-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-codec-gstreamer-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-devel-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-jack-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-lang-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-noX-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-opencv-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-qt-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-vdpau-3.0.18-bp153.2.6.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YI4EVQJJHK52U3OVX236TQ775IVEFDQS/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-0499.html</URL>
        <Description>CVE-2020-0499</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1180099</URL>
        <Description>SUSE Bug 1180099</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174302683</Note>
    </Notes>
    <CVE>CVE-2021-0561</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Package Hub 15 SP3:libvlc5-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:libvlccore9-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-codec-gstreamer-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-devel-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-jack-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-lang-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-noX-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-opencv-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-qt-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-vdpau-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:libvlc5-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:libvlccore9-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-codec-gstreamer-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-devel-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-jack-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-lang-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-noX-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-opencv-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-qt-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-vdpau-3.0.18-bp153.2.6.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.1</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YI4EVQJJHK52U3OVX236TQ775IVEFDQS/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2021-0561.html</URL>
        <Description>CVE-2021-0561</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1196660</URL>
        <Description>SUSE Bug 1196660</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.</Note>
    </Notes>
    <CVE>CVE-2022-41325</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Package Hub 15 SP3:libvlc5-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:libvlccore9-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-codec-gstreamer-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-devel-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-jack-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-lang-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-noX-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-opencv-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-qt-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:vlc-vdpau-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:libvlc5-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:libvlccore9-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-codec-gstreamer-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-devel-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-jack-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-lang-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-noX-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-opencv-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-qt-3.0.18-bp153.2.6.1</ProductID>
        <ProductID>openSUSE Leap 15.3:vlc-vdpau-3.0.18-bp153.2.6.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV3>
        <BaseScoreV3>7.8</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YI4EVQJJHK52U3OVX236TQ775IVEFDQS/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-41325.html</URL>
        <Description>CVE-2022-41325</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1206142</URL>
        <Description>SUSE Bug 1206142</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
