Often it is impossible at first sight to understand if a package in a repository is up-to-date with security fixes, because the maintainers use a different naming when applying the patches to old branches. So for example, while Foo version 1.2.3 might be old and insecure, version Foo 1.2.3-ubuntu123 might contain security patches and be as secure as the latest Foo version 1.5.7. It seems to me there's no easy way to find out whether all patches have been applied, unless you check and compare the changelogs.
However I just tried checking the status of the VLC package in the latest Ubuntu LTS (20.04 Focal Fossa), and to me it looks like it's never been patched and has at least a few vulnerabilities discovered in the last year or so. But that would be pretty worrying, something I would not expect from one of the most popular applications on a LTS release of one of the major distributions. So maybe there's something wrong with my reasoning. Here's what I did:
- Checked available version in Ubuntu's repos: VLC 3.0.9.2-1 (using
apt show vlc
, also see https://packages.ubuntu.com/focal/vlc ) - Checked latest version on VLC's website: VLC 3.0.14
- Checked the changelog of VLC 3.0.9.2-1: it was released in April 2020. See: https://changelogs.ubuntu.com/changelogs/pool/universe/v/vlc/vlc_3.0.9.2-1/changelog
- Checked VLC security advisories: https://www.videolan.org/security/
- Noticed that there are at least three versions released after April 2020 that fixed several security vulnerabilities (versions: 3.0.11, 3.0.12, 3.0.13).
- Conclusion: VLC 3.0.9.2-1 from Ubuntu's repo cannot include security fixes that came out after April 2020, and considering that Ubuntu 20.04 was released in April 2020, the VLC package maybe was never even updated.
By the way, I noticed that in the security page on VLC's website there are no "security advisories" after 2019, yet there are "security bulletins" related to the releases, so could it be that the repo maintainers missed the fact that VLC had security issues in 2020? Also, the VLC change log looks a bit weird to me, because if you look for "security" the first section named "security" is in "changes between 3.0.6 and 3.0.7". Before that, the word "security" is first mentioned in a "misc" section about "changes between 3.0.x and 4.0.0-dev". I wonder if the repo maintainers thought there were nothing to fix because there isn't a section named "security" for the latest versions.
Anyway, the question is: is my reasoning correct, and therefore the current VLC package provided by the official repos of Ubuntu LTS 20.04 Focal Fossa is actually insecure because some vulnerabilities have not been patched? If so, shouldn't this be something very worrying about one of the most popular packages in one of the most popular distros? If my reasoning is wrong instead, where is the mistake? Is there a better way to check if a package has been patched, or can we only hope everything is ok and trust the maintainers?