lp://staging/ubuntu/edgy-security/vlc

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Related blueprints

22. By Emanuele Gentili on 2008-03-11

* SECURITY UPDATE:
  - debian/patches/CVE-2008-0984.patch (LP: #195949)
   + VLC media player's MPEG-4 file format parser (a.k.a. the MP4 demuxer)
     suffers from an arbitrary memory overwrite vulnerability when using
     crash the player instance.

* References
  - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0984
  - http://www.videolan.org/security/sa0802.html

21. By magilus on 2007-01-27

* SECURITY UPDATE: arbitrary code execution via format strings.
* MOAB-02-01-2007-CVE-2007-0017.patch: Fix format string vulnerability
  with patch taken from Debian BTS (Closes LP#78610).
* References:
  CVE-2007-0017

20. By Daniel T Chen on 2006-10-18

* Merge from Debian unstable, remaining Ubuntu changes:
  - debian/control: Don't build-depend on libtwolame-dev, a newer
    version of libcaca-dev, or linux-kernel-headers (Ubuntu Edgy
    does not have them),
  - debian/patches/001_1008snap.{fixes,translations}.diff: Remove,
    this is a new upstream version, fixes FTBFS on translations,
  - debian/rules: Use Ubuntu-specific configure options (firefox).
* New upstream snapshot fixes wxvlc not stopping when 'close
  button' is clicked (Closes Ubuntu: #54630).
* New upstream snapshot has more robust x264 support
  (Closes: Ubuntu #62217).
* Segfault when using HTTP interface was fixed in
  0.8.6-svn20060918.debian-1ubuntu4 (Closes Ubuntu: #63833).
* New upstream snapshot should resolve issues with skins2/wxw
  interfaces (Closes: Ubuntu #64975).

19. By Daniel T Chen on 2006-10-09

* Backport fixes from Debian's 10/08 snapshot, fixing heap smashing
  with HTTP interface (Closes Ubuntu: #63833),
* Realign packaging with Debian's 10/08 snapshot, updating rules
  and *.install,
* Correct previous changelog entry that erroneously marked Ubuntu
  #62856 as resolved.

18. By Daniel T Chen on 2006-09-30

Backport fixes from Debian's 0925 snapshot, fixing failure to
read rtsp streams from Freebox (Closes Ubuntu: #62856, #63135).

17. By Daniel T Chen on 2006-09-24

debian/rules: Remove --enable-dmo --enable-loader from i386
$(vlc_confflags). With the dh_install -si --fail-missing
semantics, arch-specific exceptions aren't possible. Fixes
FTBFS on i386.

16. By Daniel T Chen on 2006-09-24

* Merge from Debian unstable. The following Ubuntu changes remain:
  - debian/control:
    + Build-Depend on firefox-dev, not libxul-dev and xulrunner,
    + Build-Depend on linux-libc-dev, not linux-kernel-headers,
    + Remove libtwolame-dev (not in Ubuntu) from Build-Depends,
    + Loosen build-dependency for libcaca-dev to (>= 0.9),
      NOTE: This change may result in subpar colour ASCII
      rendering. Please see http://bugs.debian.org/385174 for
      rationale,
    + Set the maintainer field to
      MOTU Media Team <email address hidden> (we're responsible
      for Ubuntu vlc breakage, not Debian), =)
  - debian/rules:
    + Retain UBUNTU_ENV, still using firefox,
    + Add --enable-dmo --enable-loader to $(vlc_confflags) on i386,
      allowing use of proprietary codecs,
    + Remove --enable-twolame (see above change to debian/control).

15. By Daniel T Chen on 2006-08-26

* Merge from Debian unstable. The remaining Ubuntu changes are:
  - debian/control:
    + Build-Depend on firefox-dev, not libxul-dev and xulrunner,
    + Build-Depend on linux-libc-dev, not linux-kernel-headers,
    + Remove libtwolame-dev (not in Ubuntu) from Build-Depends,
    + Loosen build-dependency for libcaca-dev to (>= 0.9),
      NOTE: This change may result in subpar colour ASCII
      rendering. Please see http://bugs.debian.org/385174 for
      rationale,
    + Set the maintainer field to
      MOTU Media Team <email address hidden> (we're responsible
      for Ubuntu vlc breakage, not Debian), =)
  - debian/patches/21_gnome-screensaver-support.dpatch: Drop.
    Upstream has merged a version using DBUS.
  - debian/rules:
    + Retain UBUNTU_ENV, still using firefox,
    + Add --enable-dmo --enable-loader to $(vlc_confflags) on i386,
      allowing use of proprietary codecs,
    + Remove --enable-twolame (see above change to debian/control),
* Fix installation of .desktop file (closes Ubuntu: #53471).

14. By Daniel T. Chen <email address hidden> on 2006-07-12

* Merge from debian unstable:
  - debian/control: Build-Depend on firefox-dev, not libxul-dev and
    xulrunner.
  - debian/patches/:
    + 01_libhal_api-libvlc.c.dpatch: Drop, integrated upstream.
    + 020_xulrunner.diff: Disable, still using firefox.
    + 21_gnome-screensaver-support.dpatch: Retain.
    + 22_avahi_client_0.6_api.dpatch: Drop, integrated upstream.
    + 24_prefs_stacking_fix.dpatch: Drop, backported from now-current
      upstream.
  - debian/rules:
    + Retain UBUNTU_ENV, still using firefox.
    + Add --enable-dmo --enable-loader to $(vlc_confflags) on i386,
      allowing use of proprietary codecs (Closes Ubuntu: #48391).
  (Closes Ubuntu: #40723, #45516, #45519, #46832, #50857, #51117,
  #52273)

13. By Daniel T Chen on 2006-05-23

"'Time to race', she said, 'Race the downhill'."

* Add debian/patches/24_prefs_stacking_fix, fixing stacking in
  Preferences dialog. Taken from upstream svn changeset 13795, thanks
  to Bruce Cowan (Closes: Malone #31891).
* Demote ttf-freefont, ttf-thryomanes to Suggests as the former
  provides bad metrics for Thai. See Debian #362071 for additional
  information.
* Don't use gcc-snapshot as the compiler. See Debian #361729 for more
  information.
* Make vlc.desktop HIG-compliant.
* Rebuild against new libebml-dev and libmatroska-dev, fixing crashes
  with Matroska files (Closes: Malone #29644).
* Use our own faad2 and x264, fixing garbled graphics (Closes: Malone
  #28539). Please see Debian #365389 if the inclusion of these
  libraries stirs your ire.