id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
6880	libvdpau-1.1.1	Fernando de Oliveira	Fernando de Oliveira	"[http://people.freedesktop.org/~aplattner/vdpau/libvdpau-1.1.1.tar.bz2]

[http://people.freedesktop.org/~aplattner/vdpau/libvdpau-1.1.1.tar.bz2.sig]

'''CVE-2015-5198, CVE-2015-5199, and CVE-2015-5200'''

''If you use the NVIDIA .run installer packages, please see
[https://devtalk.nvidia.com/default/topic/873035] for additional
information.''

[http://lists.freedesktop.org/archives/vdpau/2015-August/000376.html]

and

[http://lists.freedesktop.org/archives/vdpau/2015-August/000377.html]

MD5:    2fa0b05a4f4d06791eec83bc9c854d14  libvdpau-1.1.1.tar.bz2

{{{
[VDPAU] libvdpau 1.1.1
Aaron Plattner aplattner at nvidia.com
Mon Aug 31 14:16:33 PDT 2015

libvdpau versions 1.1 and earlier, when used in setuid or setgid
applications, contain vulnerabilities related to environment
variable handling that could allow an attacker to execute
arbitrary code or overwrite arbitrary files.  See CVE-2015-5198,
CVE-2015-5199, and CVE-2015-5200 for more details.

This release uses the secure_getenv() function, when available,
to fix these problems. On platforms where secure_getenv() is not
available, the VDPAU environment variables will not be honored by
the library.

If you use the NVIDIA .run installer packages, please see
https://devtalk.nvidia.com/default/topic/873035 for additional
information.

This release also adds tracing of HEVC picture structures to
libvdpau_trace.


Aaron Plattner (2):
      Remove pdflatex dependency
      Bump version to 1.1.1

Bibhuti Prusty (1):
      Add tracing for HEVC picture info

Emil Velikov (3):
      .gitignore: add compile
      configure.ac: remove AM_MAINTAINER_MODE
      autogen.sh: update/copy over from mesa

José Hiram Soltren (2):
      Fix Doxygen typo: s/no queued/not queued/
      Use secure_getenv(3) to improve security

Errata:

[VDPAU] libvdpau 1.1.1
Aaron Plattner aplattner at nvidia.com
Mon Aug 31 14:28:25 PDT 2015

On 08/31/2015 02:16 PM, Aaron Plattner wrote:
> On platforms where secure_getenv() is not available, the VDPAU
> environment variables will not be honored by the library.

Whoops, this is incorrect, sorry.  The updated libvdpau will
instead use a fallback implementation of secure_getenv() when the
platform doesn't provide one.
}}}"	enhancement	closed	high	7.8	BOOK	SVN	medium	fixed