{"id":"openSUSE-SU-2026:22198-1","summary":"Security update for vlc","details":"This update for vlc fixes the following issues:\n\nChanges in vlc:\n\n- Add conditional for pkgconfig(vpl) BuildRequires and plugin,\n  exclude %{arm} ppc64le %{ppc} s390x.\n- Add conditional for pkgconfig(libnfs) BuildRequires and plugin,\n  exclude %{arm}\n\n- Switch to qt6:\n  * Drop libQt5Gui-private-headers-devel, pkgconfig(Qt5Core),\n    pkgconfig(Qt5Gui), pkgconfig(Qt5Svg), pkgconfig(Qt5Widgets) and\n    pkgconfig(Qt5X11Extras). Further: disable pkgconfig(libprojectM) and drop\n    outright conditional pkgconfig(libprojectM-qt5).\n  * Add qt6-base-private-devel, qt6-gui-private-devel, pkgconfig(Qt6Core),\n    pkgconfig(Qt6Gui), pkgconfig(Qt6Svg) and pkgconfig(Qt6Widgets).\n\n- Add pkgconfig(vpl) BuildRequires: Build qsv plugin.\n\n- Require vlc from vlc-devel: whereas the desktop app is not exactly needed\n  when building against the libraries, many consumers expect the full stack to\n  be present.\n\n- Drop schroedinger-devel BuildRequires: Not needed, nor used.\n  Upstream removed support in 3.0.24\n\n- Rework subpackaging\n  * Split the desktop output plugins out of the main vlc package,\n    for use on headless systems\n  * Installing vlc-noX and vlc-plugins-desktop will now give a\n    fully functional CLI installation, without pulling in the\n    graphical frontend\n  * Main 'vlc' package will now pull in all components for desktop\n    GUI interface\n\n- Update to version 3.0.24:\n  + Codecs:\n    - Use FFmpeg 8.1 (upgraded from 4.4)\n    - Support APV decoder (FFmpeg 8)\n    - Support Atrac3/Atrac9 decoding\n    - Remove schroedinger support for dirac in favor of avcodec\n    - Fix Speex leaks and packetization issues\n    - Fix WebVTT CSS parsing and error handling\n    - Fix FLAC and HEVC packetizer edge cases\n    - Fix AudioToolbox MIDI synthesizer crash on macOS 26+\n  + Demuxers:\n    - Add support for CEA-708 closed captions in MP4\n    - Expose ID3v2 metadata in MPEG demuxer\n    - Improve subtitle language detection from filenames and SSA/ASS metadata\n    - Fix several MKV crashes, leaks, hangs and malformed file handling issues\n    - Fix AVI hang with zero-sized strd chunks\n    - Fix MP4, MPEG-TS, Ogg, RealAudio and subtitle demuxing edge cases\n  + Access:\n    - Switch RIST input and output to librist, with main and simple profile support\n    - Add SRT listener mode support\n    - Add SFTP public key authentication options and ED25519 hostkey support\n    - Update SMB2 share enumeration\n    - Don't ship RealRTSP plugin (build disabled for all configurations)\n  + Service Discovery:\n    - Include Chromecast model in mDNS renderer names\n    - Fix IPv6 addresses in Bonjour service URLs\n  + Video Output:\n    - Fix Direct3D11 adjust filter and texture leaks\n    - Fix MediaCodec crop validation\n    - Super Resolution scaling with Moore Threads GPUs\n  + Interface:\n    - Qt: Fix default open dialog location\n    - Qt: Fix effects window geometry saving\n    - Qt: Improve hotkeys dialog strings\n  + Stream Output:\n    - Disable HEVC for original Chromecast devices\n  + Security:\n    - Switch to a new RSA-4096 key for update verification\n    - Fix multiple OOB, integer overflow, double-free and use-after-free issues\n    - See https://www.videolan.org/security/\n    - CVE-2026-56711: picture: inline AllocatePicture() and use overflow helpers (boo#1279900)\n  + Misc:\n    - Add Flatpak build support\n    - Fix Audio EQ filter High Frequency parameter\n    - Fix artwork preparser crash when artwork title is null\n    - Fix LibVLC media list player race\n    - Remove NPAPI browser plugin\n  + Lua:\n    - Remove broken youtube.lua plugin\n\n- Fix Requires for ffmpeg library\n","modified":"2026-10-31T18:00:09.589689685Z","published":"2026-10-28T18:31:16Z","related":["CVE-2026-56711"],"upstream":["CVE-2026-56711"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1279900"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56711"}],"affected":[{"package":{"name":"vlc","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/vlc&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.24-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"vlc-noX":"3.0.24-bp160.1.1","vlc-lang":"3.0.24-bp160.1.1","libvlccore9":"3.0.24-bp160.1.1","vlc-codec-gstreamer":"3.0.24-bp160.1.1","vlc-devel":"3.0.24-bp160.1.1","vlc-plugins-desktop":"3.0.24-bp160.1.1","libvlc5":"3.0.24-bp160.1.1","vlc-codec-fluidsynth":"3.0.24-bp160.1.1","vlc-qt":"3.0.24-bp160.1.1","vlc":"3.0.24-bp160.1.1","vlc-jack":"3.0.24-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22198-1.json"}}],"schema_version":"1.9.2"}