xorg announce - Aug 2015 - libvdpau 1.1.1

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

VDPAU is the Video Decode and Presentation API for Unix.  This
library provides a wrapper that loads the correct vendor-specific
implementation driver library, and a tracing library to help with
debugging VDPAU applications.

libvdpau versions 1.1 and earlier, when used in setuid or setgid
applications, contain vulnerabilities related to environment
variable handling that could allow an attacker to execute
arbitrary code or overwrite arbitrary files.  See CVE-2015-5198,
CVE-2015-5199, and CVE-2015-5200 for more details.

This release uses the secure_getenv() function, when available,
to fix these problems. On platforms where secure_getenv() is not
available, the VDPAU environment variables will not be honored by
the library.

If you use the NVIDIA .run installer packages, please see
https://devtalk.nvidia.com/default/topic/873035 for additional
information.

This release also adds tracing of HEVC picture structures to
libvdpau_trace.


Aaron Plattner (2):
      Remove pdflatex dependency
      Bump version to 1.1.1

Bibhuti Prusty (1):
      Add tracing for HEVC picture info

Emil Velikov (3):
      .gitignore: add compile
      configure.ac: remove AM_MAINTAINER_MODE
      autogen.sh: update/copy over from mesa

José Hiram Soltren (2):
      Fix Doxygen typo: s/no queued/not queued/
      Use secure_getenv(3) to improve security

git tag: libvdpau-1.1.1

http://people.freedesktop.org/~aplattner/vdpau/libvdpau-1.1.1.tar.bz2
MD5:    2fa0b05a4f4d06791eec83bc9c854d14  libvdpau-1.1.1.tar.bz2
SHA1:   86516e2a962fd34f65d49115d6ddf15fd912f579  libvdpau-1.1.1.tar.bz2
SHA256: 857a01932609225b9a3a5bf222b85e39b55c08787d0ad427dbd9ec033d58d736 
libvdpau-1.1.1.tar.bz2
PGP:   
http://people.freedesktop.org/~aplattner/vdpau/libvdpau-1.1.1.tar.bz2.sig
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJV5MPPAAoJEBvvPYQBpohh33QP/3aha1W2ARz1lRWX5BLLp+VW
wdJ6qEeisQpIFzH4HIgVSAPS7dNdECgX0OasmlIfHe4KMm/F0upW6/p0Xs85d6w/
i6yU7hzRI7OFLDFXAez0Q5SJbl+J9SS6VbgpbhbLocyr1KVxTG0ArAoH6dWAqUv6
66S+BFK2GpmKbwHwmKAnp/NKB5neb9ISO+s2MC5wpOjK3JwU76DzClv017eLMAKw
NVg3i48kkovkbtZu+vR3utX6MKelIPiY/BvPL1Rtxw7cHLGWnNLGi1KQGoxCGtYp
RQUorRtF8pCTnE1/sTkNyVroh2467AlAMPrYJYxKG6/OfUcQVcJPDdYn+N86x9qy
ikCOJR4FIMs6bXmzXNc6n0spBq2Y8YePvMLA56p7d3iDCUzagNzkeVc+U9pp38X2
NXwqkmiXbWi4abHh4wF9QLLzbzJbdCMSc9HRFpNO4hgicD/WVEZqlxfb8KNM97kp
bjdR+czYCB2tur4249SA+c91DCVwiOHk1gANwJ2WtUPC1TgfbfbLOINTDmKj6ZlS
zdSVcGKkpTjb0nFoRZDXhwzIlZXvJzAlJpJBf04IZuX6AbYmk4pKUVYKfnRNKYMD
JWgrToJJepvGRj4cwCFTR3LYG7dMI6+vAxSoWcw/Tjo03MtOUyW0LxdbP4k+Ti6H
Caswf2KKJ+gy4gnC77YZ
=4GZm
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 08/31/2015 02:16 PM, Aaron Plattner wrote:
> On platforms where secure_getenv() is not available, the VDPAU
> environment variables will not be honored by the library.
Whoops, this is incorrect, sorry.  The updated libvdpau will
instead use a fallback implementation of secure_getenv() when the
platform doesn't provide one.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJV5MahAAoJEBvvPYQBpohh2poQALgei0eqWZpNajmWRjBHUc45
W/puNKVJaBVtf26sqXfg9c8fOwPxSo0EPi35gIN/hq0MdDGXdifDiK/iDb67fKuJ
0HvWnUFYdNeDRdrbLk2CDu6pnGiij7nnv+KRDy5OTL5uPwwNzyRh5UgxTqdB+Dq3
uuqBFejp6h4gqSo9FhZNDSG9UStqyeOjcTL2oRBgGRU9JLjmtWSxNONDXtLcanXr
kNTH7sw3JHzj3gaEBk+w34RYIGXJBgMn5LMOsVF+Q4cxEusys+pQJj66UZlKqazo
TRHE4V9Ywm2krjhl3IjygktI+roaak2ofyMFz0V44N73gJpigNueP/bb4VwhdneK
e2SzpLD6hD46n2fMrm/DDXqK5ELHmAuN9SMiolAdYoliTPQMTJKSKuDBDkYrB8R8
g0aTVjAZEnQJ8xAnzcezFSDk7UJP27srx5H8BEUT600OrOVt8zj7RYwm/9BYqYOi
8qESIkkwpMEsiW89opTigqhLDcT3torKkPVZql3jK/LlSwM0Hxl42uFmls5fuevQ
IsPtz53EwmjRGpwMu9f5widnqtqYX0TTX9RP0CPsNPsPRzbg3Fa9kWedshqzVmWV
Z6lShqq3ZGVsj/YYm7wSILj84AT5s4byYne6xolrlpPZU1ATLiXy5e59lL/Ontpi
tMqiRCv2P8PO6uHBLlPj
=fhUK
-----END PGP SIGNATURE-----