Quote:Maintainers of the popular open-source VLC media player patched two high-severity bugs Friday. The flaws were an out-of-bound write vulnerability and a stack-buffer-overflow bug. Developers behind the software, VideoLAN, said the patches were two of 33 fixes being pushed out to the media player and part of a new bug bounty program funded by European Commission.
 
“This high number of security issues is due to the sponsoring of a bug bounty program funded by the European Commission, during the Free and Open Source Software Audit (FOSSA) program,” wrote Jean-Baptiste Kempf, president of VideoLAN and open source developer in a post outlining the patches.
 
In January, the EU funded 14 bug bounty programs in hopes of keeping open source projects that EU institutions rely on secure. The program is maintained by the HackerOne bounty program facilitator.

Details are scant on the two high-severity bugs and how they could be exploited. Impacted is VLC 3.0.7 and the EU-FOSSA release of the player, along with code tied to the upcoming 4.0 release of the player.
“We just released VLC 3.0.7, a minor update of VLC branch 3.0.x. This release is a bit special, because it has more security issues fixed than any other version of VLC,” Kempf wrote.