The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22198-1 advisory.

    Changes in vlc:

    - Add conditional for pkgconfig(vpl) BuildRequires and plugin,       exclude %{arm} ppc64le %{ppc} s390x.
    - Add conditional for pkgconfig(libnfs) BuildRequires and plugin,       exclude %{arm}

    - Switch to qt6:
      * Drop libQt5Gui-private-headers-devel, pkgconfig(Qt5Core),         pkgconfig(Qt5Gui), pkgconfig(Qt5Svg), pkgconfig(Qt5Widgets) and         pkgconfig(Qt5X11Extras). Further: disable pkgconfig(libprojectM) and drop         outright conditional pkgconfig(libprojectM-qt5).
      * Add qt6-base-private-devel, qt6-gui-private-devel, pkgconfig(Qt6Core),         pkgconfig(Qt6Gui), pkgconfig(Qt6Svg) and pkgconfig(Qt6Widgets).

    - Add pkgconfig(vpl) BuildRequires: Build qsv plugin.

    - Require vlc from vlc-devel: whereas the desktop app is not exactly needed       when building against the libraries, many consumers expect the full stack to       be present.

    - Drop schroedinger-devel BuildRequires: Not needed, nor used.
      Upstream removed support in 3.0.24

    - Rework subpackaging
      * Split the desktop output plugins out of the main vlc package,         for use on headless systems
      * Installing vlc-noX and vlc-plugins-desktop will now give a         fully functional CLI installation, without pulling in the         graphical frontend
      * Main 'vlc' package will now pull in all components for desktop         GUI interface

    - Update to version 3.0.24:
      - Codecs:
        - Use FFmpeg 8.1 (upgraded from 4.4)
        - Support APV decoder (FFmpeg 8)
        - Support Atrac3/Atrac9 decoding
        - Remove schroedinger support for dirac in favor of avcodec
        - Fix Speex leaks and packetization issues
        - Fix WebVTT CSS parsing and error handling
        - Fix FLAC and HEVC packetizer edge cases
        - Fix AudioToolbox MIDI synthesizer crash on macOS 26+
      - Demuxers:
        - Add support for CEA-708 closed captions in MP4
        - Expose ID3v2 metadata in MPEG demuxer
        - Improve subtitle language detection from filenames and SSA/ASS metadata
        - Fix several MKV crashes, leaks, hangs and malformed file handling issues
        - Fix AVI hang with zero-sized strd chunks
        - Fix MP4, MPEG-TS, Ogg, RealAudio and subtitle demuxing edge cases
      - Access:
        - Switch RIST input and output to librist, with main and simple profile support
        - Add SRT listener mode support
        - Add SFTP public key authentication options and ED25519 hostkey support
        - Update SMB2 share enumeration
        - Don't ship RealRTSP plugin (build disabled for all configurations)
      - Service Discovery:
        - Include Chromecast model in mDNS renderer names
        - Fix IPv6 addresses in Bonjour service URLs
      - Video Output:
        - Fix Direct3D11 adjust filter and texture leaks
        - Fix MediaCodec crop validation
        - Super Resolution scaling with Moore Threads GPUs
      - Interface:
        - Qt: Fix default open dialog location
        - Qt: Fix effects window geometry saving
        - Qt: Improve hotkeys dialog strings
      - Stream Output:
        - Disable HEVC for original Chromecast devices
      - Security:
        - Switch to a new RSA-4096 key for update verification
        - Fix multiple OOB, integer overflow, double-free and use-after-free issues
        - See https://www.videolan.org/security/
        - CVE-2026-56711: picture: inline AllocatePicture() and use overflow helpers (boo#1279900)
      - Misc:
        - Add Flatpak build support
        - Fix Audio EQ filter High Frequency parameter
        - Fix artwork preparser crash when artwork title is null
        - Fix LibVLC media list player race
        - Remove NPAPI browser plugin
      - Lua:
        - Remove broken youtube.lua plugin

    - Fix Requires for ffmpeg library

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

openSUSE 16: libvlc5 / libvlccore9 / vlc / vlc-codec-fluidsynth / etc (openSUSE-SU-2026:22198-1)

high Nessus Plugin ID 374757

Version 1.2