vlc-3.0.23

[Bruce Dubbs]

New point version.

[Douglas R. Reno]

VLC media player 3.0.22 'Vetinari'

This is the twenty-third release of VLC 3.0 branch, named "Vetinari",
in reference to the Lord Patrician from Discworld.

This update contains a few improvements and some important fixes:
- Add option to use dark palette on Qt interface (Windows & Linux)
- Add Windows ARM64 builds
- Fix support for Windows XP SP3 and some older macOS versions
- Allow renaming/moving/deleting of playing file on Windows
- Add A_ATRAC/AT1 support in matroska
- Add AMD GPU Frame Rate Doubler (Direct3D11)
- And a very large number of security issues fixed thanks to STF and oss-fuzz

and:
- Add compilation support for Qt6 and newer versions of Qt5
- Prevent FLAC seeking logic get stuck
- Handle pictures in FLAC
- Fix VOB/AOB LPCM/MLP detection failing occasionally
- Cut QNap title on first invalid character
- Fix display of certain JPEG files
- Fix playback of very short ASF files (duration less than 1s)
- Fix crashes in multiple demuxers (reported by rub.de, oss-fuzz and others)
- Fix SFTP seeking for large files on 32-bit OS
- Fix Opus channel mapping
- Fix hardware decoding with VideoToolbox of XVID MPEG-4 video
- Fix DVD CEA-608 captions parsing
- Fix ProRes 4:4:4:4
- Disable decoding using libdca, libmpeg2 and liba52 by default in favor of libavcodec
- Add dav1d-all-layers option
- Restrict SystemParametersInfo calls to Windows XP
- Handle mkv-use-chapter-codec option
- UPnP: remove SAT>IP channel list fallback
- Use a better stretch mode in wingdi
- Fetch missing device information when running in UWP
- Qt: Add option to use dark palette
- Qt: Add compilation support for newer versions of Qt5
- Qt: Fix scrolling on volume slider
- macOS: fix crashes when drag'n drop items in the playlist
- KDE: fix MPRIS state when started from file

Many thanks to the Sovereign Tech Agency (https://www.sovereign.tech/), and
especially their Sovereign Tech Fund program, for helping VLC sustainability and safety.
Thanks to oss-fuzz as well for their help and resources to find issues.
Thanks to their support, 3.0.22 becomes the VLC release with the most security fixes ever!

The security bulletin does not appear to be available yet

[Bruce Dubbs]

Fixed at commit 648ce9dfd2.

Holding open and reassigning for security advisory.

[Douglas R. Reno]

At this time, no security information has appeared on ​https://www.videolan.org/security/ even though the release notes have mentioned security fixes.

For now, let's move this to 99-waiting and continue checking a couple times a day, just do it doesn't stay in the report.

[pierre]

Replying to Douglas R. Reno:

At this time, no security information has appeared on ​https://www.videolan.org/security/ even though the release notes have mentioned security fixes.

Actually, even the download link at videolan is still at 3.0.21!

For now, let's move this to 99-waiting and continue checking a couple times a day, just do it doesn't stay in the report.

[Bruce Dubbs]

Replying to pierre:

Replying to Douglas R. Reno:

At this time, no security information has appeared on ​https://www.videolan.org/security/ even though the release notes have mentioned security fixes.

Actually, even the download link at videolan is still at 3.0.21!

But the link in BLFS is correct.

[Douglas R. Reno]

Still waiting on details from upstream on this. However, looking at their Gitlab I found that 3.0.23 has been tagged (though it's not available for download yet):

VLC media player 3.0.23 'Vetinari'

This is the twenty-fourth release of VLC 3.0 branch, named "Vetinari",
in reference to the Lord Patrician from Discworld.

3.0.23 is just a small fixup release compared to 3.0.22, fixing issues
mostly on Windows for image display, security warnings, OpenGL.
It also adds a small feature on audio codec information, and fixes extra
security issues compared to the numerous we fixed in 3.0.22.

[Douglas R. Reno]

Sent an email to VLC's security team and CCed Zeckma and Bruce.

[Douglas R. Reno]

At the moment, still no updates on the security contents other than "that they exist". I haven't heard back from the security team at VLC, and the website still shows 3.0.21 as most current.

[Joe Locash]

3.0.23 is now available for download.

Changes between 3.0.22 and 3.0.23:
----------------------------------

Codecs:
 * Fix WebVTT line positioning
 * Expose additional audio codec information (notably for Flac 24bit)

Demuxers:
 * fix some JPEG files wih JFIF headers

Windows:
 * config_GetUserDir() no longer tries to create the folder on Windows (#29488)
 * Fix images display with D3D11
 * Improve dark palette in Qt interface
 * Fix compilation of OpenGL modules

Security:
 * Fix null deref in libass, undefined shift in theora and cc-708, integer overflow in daala,
   Infinite loop in h264 parsing, buffer overflow in png and multiple format-overflows

Misc:
 * Prepare compatibility for taglib 2.0, Qt6, FFmpeg8, mingw-w64 v13 and newer versions of
   libplacebo and pupnp

The patch for ffmpeg is no longer needed. I updated the book with commit e6180aafcf.

[zeckma]

​https://www.videolan.org/security/sb-vlc3022.html was posted. I'll sort and write out everything soon.

[zeckma]

There seems to be only one CVE assigned: CVE-2025-51602, which Ubuntu rates at Medium. It's for an out-of-bounds read. There are more vulnerabilities not assigned.

11 out-of-bounds reads (including CVE-2025-51602), 4 out-of-bounds writes, 1 invalid free(), 1 stack overflow, 1 integer overflow, 1 null dereference, 1 undefined shift, 1 infinite loop, 1 buffer overflow, and 1 multiple-format overflow.

So in total, 22 or 23 vulnerabilities were fixed. For the out-of-bounds reads and writes, one instance allows both reads and writes and probably stems from the same issue. So I'll probably go with 22 here.

[zeckma]

Rating as Critical.

[zeckma]

SA-12.4-070 issued.

[Bruce Dubbs]

Milestone renamed