openSUSE-SU-2026:22198-1

Dashboard / Vulnerabilities / openSUSE-SU-2026:22198-1

openSUSE-SU-2026:22198-1

Summary: Security update for vlc

Details: This update for vlc fixes the following issues: Changes in vlc: - Add conditional for pkgconfig(vpl) BuildRequires and plugin, exclude %{arm} ppc64le %{ppc} s390x. - Add conditional for pkgconfig(libnfs) BuildRequires and plugin, exclude %{arm} - Switch to qt6: * Drop libQt5Gui-private-headers-devel, pkgconfig(Qt5Core), pkgconfig(Qt5Gui), pkgconfig(Qt5Svg), pkgconfig(Qt5Widgets) and pkgconfig(Qt5X11Extras). Further: disable pkgconfig(libprojectM) and drop outright conditional pkgconfig(libprojectM-qt5). * Add qt6-base-private-devel, qt6-gui-private-devel, pkgconfig(Qt6Core), pkgconfig(Qt6Gui), pkgconfig(Qt6Svg) and pkgconfig(Qt6Widgets). - Add pkgconfig(vpl) BuildRequires: Build qsv plugin. - Require vlc from vlc-devel: whereas the desktop app is not exactly needed when building against the libraries, many consumers expect the full stack to be present. - Drop schroedinger-devel BuildRequires: Not needed, nor used. Upstream removed support in 3.0.24 - Rework subpackaging * Split the desktop output plugins out of the main vlc package, for use on headless systems * Installing vlc-noX and vlc-plugins-desktop will now give a fully functional CLI installation, without pulling in the graphical frontend * Main 'vlc' package will now pull in all components for desktop GUI interface - Update to version 3.0.24: + Codecs: - Use FFmpeg 8.1 (upgraded from 4.4) - Support APV decoder (FFmpeg 8) - Support Atrac3/Atrac9 decoding - Remove schroedinger support for dirac in favor of avcodec - Fix Speex leaks and packetization issues - Fix WebVTT CSS parsing and error handling - Fix FLAC and HEVC packetizer edge cases - Fix AudioToolbox MIDI synthesizer crash on macOS 26+ + Demuxers: - Add support for CEA-708 closed captions in MP4 - Expose ID3v2 metadata in MPEG demuxer - Improve subtitle language detection from filenames and SSA/ASS metadata - Fix several MKV crashes, leaks, hangs and malformed file handling issues - Fix AVI hang with zero-sized strd chunks - Fix MP4, MPEG-TS, Ogg, RealAudio and subtitle demuxing edge cases + Access: - Switch RIST input and output to librist, with main and simple profile support - Add SRT listener mode support - Add SFTP public key authentication options and ED25519 hostkey support - Update SMB2 share enumeration - Don't ship RealRTSP plugin (build disabled for all configurations) + Service Discovery: - Include Chromecast model in mDNS renderer names - Fix IPv6 addresses in Bonjour service URLs + Video Output: - Fix Direct3D11 adjust filter and texture leaks - Fix MediaCodec crop validation - Super Resolution scaling with Moore Threads GPUs + Interface: - Qt: Fix default open dialog location - Qt: Fix effects window geometry saving - Qt: Improve hotkeys dialog strings + Stream Output: - Disable HEVC for original Chromecast devices + Security: - Switch to a new RSA-4096 key for update verification - Fix multiple OOB, integer overflow, double-free and use-after-free issues - See https://www.videolan.org/security/ - CVE-2026-56711: picture: inline AllocatePicture() and use overflow helpers (boo#1279900) + Misc: - Add Flatpak build support - Fix Audio EQ filter High Frequency parameter - Fix artwork preparser crash when artwork title is null - Fix LibVLC media list player race - Remove NPAPI browser plugin + Lua: - Remove broken youtube.lua plugin - Fix Requires for ffmpeg library

References: , https://bugzilla.suse.com/1279900, https://www.suse.com/security/cve/CVE-2026-56711