2

A security flaw, potentially serious has been found in VLC:

The vulnerability allows for RCE (remote code execution) which potentially allows bad actors attackers to install, modify, or run software without authorization, and could also be used to disclose files on the host system. Translation: VLC’s security hole could allow hackers to hijack your computer and see your files.

However, it might not be that bad:

[Update 8:35 AM] Based on a tweet by VideoLAN, VLC may not be as vulnerable as it initially appeared. VideoLAN says the “security issue” in VLC was caused by a third-party library called Libebml that was fixed 16 months ago, and that Mitre’s claim was based on a previous (and outdated) version of VLC.

Either way this sounds pretty intense... Should I be immediately uninstalling VLC? How vulnerable is Ubuntu LTS vs Current?

Improve this question
2
  • 4
    No. If VideoLan say it's been patched then it's been patched. I'm not worried anyway and I often use SMPlayer which in some respects I find plays videos and DVDs better than VLC.
    – Paul Benson
    Jul 24, 2019 at 22:11
  • 3
    This genre of question pops up rather often. Related: askubuntu.com/questions/1153346/…
    – DK Bose
    Jul 25, 2019 at 3:17

1 Answer 1

Reset to default
3

There was an Ubuntu Security Notice issued addressing the matter and indicating that a patch was available concerning the flaw in the library that had the vulnerability. Versions impacted were 16.04 and 18.04. The updated package was posted by the security team to the package archive the day after this question was originally posted.

In short, you should simply let Update Manager run as normal rather than uninstall VLC.

A general FAQ concerning the Ubuntu Security Team is available for review.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .