Hi, On 2026-10-26 16:29:32 -0500, Simon Quigley wrote: > Hello, > > I've prepared vlc 3.0.24-0+deb12u1 for bookworm-security, and it's ready for > review. > > vlc 3.0.24-0+deb13u1 in Trixie already has this, in DSA-6515-1. I would > usually attach a debdiff, but it's large (15 MB), so you're likely better off > looking at Salsa commits or the debdiff in Debusine. > > This is the 3.0.24 upstream release, the same tarball as that DSA. The three > CVE patches (CVE-2026-56711, CVE-2026-73324, and CVE-2026-102875) are in that > release. > > I built this in a Bookworm schroot. The build loads 526 plugins. I compared > the archive binaries, 3.0.23-0+deb12u1, with this package on the skin archive > and the SAT>IP teardown, and a generated WAV plays through the dummy audio > output. I also installed the package in a Bookworm VM, and it tests okay, > playing various video and audio files. > > Here is my Salsa fork: https://salsa.debian.org/tsimonq2/vlc/-/tree/bookworm > > Here is the Debusine work request: > https://debusine.debian.net/debian/developers/work-request/1540390/ > > Feedback is welcome. If nothing showstopping comes up, I plan to upload this > and issue the DLA on Thursday afternoon (October 29th, 2026).
Some plugins have been started to marked as unsupported upstream but have not yet been removed from vlc 3.0.x. These modules have been disabled in trixie and forky. So may want to cherry pick https://salsa.debian.org/multimedia-team/vlc/-/commit/0faad47f65ef538a04084d2e5cb604b1913b2bf7 for bookworm. Cheers -- Sebastian Ramacher
