Detections
Analytics

openSUSE 16: libvlc5 / libvlccore9 / vlc / vlc-codec-fluidsynth / etc (openSUSE-SU-2026:22198-1)

high Nessus Plugin ID 374757

Synopsis

The remote openSUSE host is missing a security update.

Description

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22198-1 advisory.

 Changes in vlc:

 - Add conditional for pkgconfig(vpl) BuildRequires and plugin, exclude %{arm} ppc64le %{ppc} s390x.
 - Add conditional for pkgconfig(libnfs) BuildRequires and plugin, exclude %{arm}

 - Switch to qt6:
 * Drop libQt5Gui-private-headers-devel, pkgconfig(Qt5Core), pkgconfig(Qt5Gui), pkgconfig(Qt5Svg), pkgconfig(Qt5Widgets) and pkgconfig(Qt5X11Extras). Further: disable pkgconfig(libprojectM) and drop outright conditional pkgconfig(libprojectM-qt5).
 * Add qt6-base-private-devel, qt6-gui-private-devel, pkgconfig(Qt6Core), pkgconfig(Qt6Gui), pkgconfig(Qt6Svg) and pkgconfig(Qt6Widgets).

 - Add pkgconfig(vpl) BuildRequires: Build qsv plugin.

 - Require vlc from vlc-devel: whereas the desktop app is not exactly needed when building against the libraries, many consumers expect the full stack to be present.

 - Drop schroedinger-devel BuildRequires: Not needed, nor used.
 Upstream removed support in 3.0.24

 - Rework subpackaging
 * Split the desktop output plugins out of the main vlc package, for use on headless systems
 * Installing vlc-noX and vlc-plugins-desktop will now give a fully functional CLI installation, without pulling in the graphical frontend
 * Main 'vlc' package will now pull in all components for desktop GUI interface

 - Update to version 3.0.24:
 - Codecs:
 - Use FFmpeg 8.1 (upgraded from 4.4)
 - Support APV decoder (FFmpeg 8)
 - Support Atrac3/Atrac9 decoding
 - Remove schroedinger support for dirac in favor of avcodec
 - Fix Speex leaks and packetization issues
 - Fix WebVTT CSS parsing and error handling
 - Fix FLAC and HEVC packetizer edge cases
 - Fix AudioToolbox MIDI synthesizer crash on macOS 26+
 - Demuxers:
 - Add support for CEA-708 closed captions in MP4
 - Expose ID3v2 metadata in MPEG demuxer
 - Improve subtitle language detection from filenames and SSA/ASS metadata
 - Fix several MKV crashes, leaks, hangs and malformed file handling issues
 - Fix AVI hang with zero-sized strd chunks
 - Fix MP4, MPEG-TS, Ogg, RealAudio and subtitle demuxing edge cases
 - Access:
 - Switch RIST input and output to librist, with main and simple profile support
 - Add SRT listener mode support
 - Add SFTP public key authentication options and ED25519 hostkey support
 - Update SMB2 share enumeration
 - Don't ship RealRTSP plugin (build disabled for all configurations)
 - Service Discovery:
 - Include Chromecast model in mDNS renderer names
 - Fix IPv6 addresses in Bonjour service URLs
 - Video Output:
 - Fix Direct3D11 adjust filter and texture leaks
 - Fix MediaCodec crop validation
 - Super Resolution scaling with Moore Threads GPUs
 - Interface:
 - Qt: Fix default open dialog location
 - Qt: Fix effects window geometry saving
 - Qt: Improve hotkeys dialog strings
 - Stream Output:
 - Disable HEVC for original Chromecast devices
 - Security:
 - Switch to a new RSA-4096 key for update verification
 - Fix multiple OOB, integer overflow, double-free and use-after-free issues
 - See https://www.videolan.org/security/
 - CVE-2026-56711: picture: inline AllocatePicture() and use overflow helpers (boo#1279900)
 - Misc:
 - Add Flatpak build support
 - Fix Audio EQ filter High Frequency parameter
 - Fix artwork preparser crash when artwork title is null
 - Fix LibVLC media list player race
 - Remove NPAPI browser plugin
 - Lua:
 - Remove broken youtube.lua plugin

 - Fix Requires for ffmpeg library

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://bugzilla.suse.com/1279900

https://www.suse.com/security/cve/CVE-2026-56711

Plugin Details

Severity: High

ID: 374757

File Name: openSUSE-2026-22198-1.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 11/1/2026

Updated: 11/1/2026

Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.5

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-56711

CVSS v3

Risk Factor: High

Base Score: 7

Temporal Score: 6.1

Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.3

Threat Score: 4.4

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:libvlc5, p-cpe:/a:novell:opensuse:libvlccore9, p-cpe:/a:novell:opensuse:vlc-codec-fluidsynth, p-cpe:/a:novell:opensuse:vlc-codec-gstreamer, p-cpe:/a:novell:opensuse:vlc-devel, p-cpe:/a:novell:opensuse:vlc-jack, p-cpe:/a:novell:opensuse:vlc-lang, p-cpe:/a:novell:opensuse:vlc-nox, p-cpe:/a:novell:opensuse:vlc-plugins-desktop, p-cpe:/a:novell:opensuse:vlc-qt, p-cpe:/a:novell:opensuse:vlc

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/28/2026

Vulnerability Publication Date: 9/9/2026

Reference Information

CVE: CVE-2026-56711