On 26/10/2026 22:29, Simon Quigley wrote:
Hello,
I've prepared vlc 3.0.24-0+deb12u1 for bookworm-security, and it's ready for
review.
vlc 3.0.24-0+deb13u1 in Trixie already has this, in DSA-6515-1. I would usually
attach a debdiff, but it's large (15 MB), so you're likely better off looking
at Salsa commits or the debdiff in Debusine.
This is the 3.0.24 upstream release, the same tarball as that DSA. The three
CVE patches (CVE-2026-56711, CVE-2026-73324, and CVE-2026-102875) are in that
release.
I built this in a Bookworm schroot. The build loads 526 plugins. I compared the
archive binaries, 3.0.23-0+deb12u1, with this package on the skin archive and the
SAT>IP teardown, and a generated WAV plays through the dummy audio output. I
also installed the package in a Bookworm VM, and it tests okay, playing various
video and audio files.
Here is my Salsa fork: https://salsa.debian.org/tsimonq2/vlc/-/tree/bookworm
Here is the Debusine work request:
https://debusine.debian.net/debian/developers/work-request/1540390/
Feedback is welcome. If nothing showstopping comes up, I plan to upload this
and issue the DLA on Thursday afternoon (October 29th, 2026).
Looks reasonable. I'd say go ahead.
Cheers,
Emilio
