unfortunately I have to release a third time within a week: this time due to a use-after-free bug in all programs that make up the MKVToolNix package. This type of vulnerability allows arbitrary code execution using specially crafted Matroska files. It was introduced in v5.5.0 and affects all following releases up to and including the latest one, v28.1.0. Hence today’s bug fix release.
You can download the source code or one of the binaries. The Windows binaries as well as the Linux AppImage are available already. The macOS binaries and the other Linux binaries are still being built and will be available of the course of the next couple of hours.
Here are the NEWS since the previous release:
- mkvmerge, mkvinfo, mkvextract, mkvpropedit, MKVToolNix GUI’s info tool &
chapter editor: fixed a case of memory being accessed after it had been
freed earlier. This can be triggered by specially crafted Matroska files and
lead to arbitrary code execution. The vulnerability was reported as Cisco
TALOS 2018-0694 on 2018-10-25.
Have fun :)