Security
Headlines
HeadlinesLatestCVEs

Headline

Debian Security Advisory 5346-1

Debian Linux Security Advisory 5346-1 - Multiple security issues were discovered in libde265, an implementation of the H.265 video codec which may result in denial of service and potentially the execution of arbitrary code if a malformed media file is processed.

Packet Storm
#linux#debian#dos#js

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512


Debian Security Advisory DSA-5346-1 [email protected]
https://www.debian.org/security/ Moritz Muehlenhoff
February 10, 2023 https://www.debian.org/security/faq


Package : libde265
CVE ID : CVE-2020-21594 CVE-2020-21595 CVE-2020-21596 CVE-2020-21597
CVE-2020-21598 CVE-2020-21599 CVE-2020-21600 CVE-2020-21601
CVE-2020-21602 CVE-2020-21603 CVE-2020-21604 CVE-2020-21605
CVE-2020-21606 CVE-2021-35452 CVE-2021-36408 CVE-2021-36409
CVE-2021-36410 CVE-2021-36411 CVE-2022-1253 CVE-2022-43235
CVE-2022-43236 CVE-2022-43237 CVE-2022-43238 CVE-2022-43239
CVE-2022-43240 CVE-2022-43241 CVE-2022-43242 CVE-2022-43243
CVE-2022-43244 CVE-2022-43245 CVE-2022-43248 CVE-2022-43249
CVE-2022-43250 CVE-2022-43252 CVE-2022-43253 CVE-2022-47655
Debian Bug : 1004963 1014977 1014999 1025816 1027179 1029357 1029396 1029397

Multiple security issues were discovered in libde265, an implementation of
the H.265 video codec which may result in denial of service and potentially
the execution of arbitrary code if a malformed media file is processed.

For the stable distribution (bullseye), these problems have been fixed in
version 1.0.11-0+deb11u1.

We recommend that you upgrade your libde265 packages.

For the detailed security status of libde265 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libde265

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmPmnM8ACgkQEMKTtsN8
TjZqphAAqRxFkOBMK21e4VGEyvX6AYyS+E2aKkREcNX9PqUGIZJ6szw/CQ1oCa0A
z3xYGLsgUDhSag4bLiirVgraJ77Vpsmc/bV72bpl1xph1azKFDqiIGGeE5/RQze7
rYIuoK7G9aAGsYY172iMcO5oGYdahMMf6DfLLgNeaijWscVMbBL69zXBx8DjPgLn
kKL7tNmDy5BxQR9O/G+LlZQWajx5VqVwdxn9bvLAMCh+NgUsnaAeRwSIja2swbQT
/45JDDAyvGnSkZOLAUn8rT6CB1OpJZZhXds5IpGcjS34AXpIEj0jnbcUzjVK4Ey1
1Ldp+EAsymEtzb33VP1v6nzpYxoTE9FGuIGmF3mtfRrJLYM4SXB/zI0oiPzQVgtT
obTNC9v3bjjmnMrldj3+jTPjrPmpk2IuqfQ/hO1ivKQ14KoIZW+tyvh1oJutYU3P
BEnTmlerU7I6yPNRkK4xLCno691Hn0qJsrk33ZcPYQw2yp2756zU41Xr1SqJTsLV
N0uo+qUILMLENq90T5umIPvSdasjCHub6ERgPrVPNdX/kcaUiaytnnnQsHnYAmGq
tcyEwFl0R1Ad1V1ddjHpaz4oFTDWxxNiUXVPDdt5pdvZaUm1M+I8HfOPLeY8tjKM
OChCcUaMbR1IDn5i48WdAVkhGwYmdVF764FamgyalFrDyKbSpsk=/99q
-----END PGP SIGNATURE-----

Related news

Gentoo Linux Security Advisory 202408-20

Gentoo Linux Security Advisory 202408-20 - Multiple vulnerabilities have been discovered in libde265, the worst of which could lead to arbitrary code execution. Versions greater than or equal to 1.0.11 are affected.

Ubuntu Security Notice USN-6659-1

Ubuntu Security Notice 6659-1 - It was discovered that libde265 could be made to write out of bounds. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code. It was discovered that libde265 could be made to read out of bounds. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service.

Ubuntu Security Notice USN-6627-1

Ubuntu Security Notice 6627-1 - It was discovered that libde265 could be made to read out of bounds. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. It was discovered that libde265 did not properly manage memory. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS.

Ubuntu Security Notice USN-6617-1

Ubuntu Security Notice 6617-1 - It was discovered that libde265 could be made to write out of bounds. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. It was discovered that libde265 could be made to write out of bounds. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

CVE-2023-28069: DSA-2022-258: Dell Streaming Data Platform Security Update for Multiple Third-Party Component Vulnerabilities

Dell Streaming Data Platform prior to 1.4 contains Open Redirect vulnerability. An attacker with privileges same as a legitimate user can phish the legitimate the user to redirect to malicious website leading to information disclosure and launch of phishing attacks.

Scanvus now supports Vulners and Vulns.io VM Linux vulnerability detection APIs

Hello everyone! Great news for my open source Scanvus project! You can now perform vulnerability checks on Linux hosts and docker images not only using the Vulners.com API, but also with the Vulns.io VM API. It’s especially nice that all the code to support the new API was written and contributed by colleagues from Vulns.io. […]

CVE-2022-43238: Unknown crash in sse-motion.cc: ff_hevc_put_hevc_qpel_h_3_v_3_sse · Issue #336 · strukturag/libde265

Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_h_3_v_3_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.

CVE-2022-43250: Heap-buffer-overflow in fallback-motion.cc: in put_qpel_0_0_fallback_16 · Issue #346 · strukturag/libde265

Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_0_0_fallback_16 in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.

CVE-2022-43249: Heap-buffer-overflow in fallback-motion.cc: void put_epel_hv_fallback<unsigned short>( · Issue #345 · strukturag/libde265

Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.

CVE-2022-43248: Heap-buffer-overflow in fallback-motion.cc: put_weighted_pred_avg_16_fallback · Issue #349 · strukturag/libde265

Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_weighted_pred_avg_16_fallback in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.

CVE-2022-43245: SEGV sao.cc: in void apply_sao_internal<unsigned short> · Issue #352 · strukturag/libde265

Libde265 v1.0.8 was discovered to contain a segmentation violation via apply_sao_internal<unsigned short> in sao.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.

CVE-2022-43244: Heap-buffer-overflow in fallback-motion.cc: in void put_qpel_fallback<unsigned short> · Issue #342 · strukturag/libde265

Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.

CVE-2022-43243: Heap-buffer-overflow in sse-motion.cc: ff_hevc_put_weighted_pred_avg_8_sse · Issue #339 · strukturag/libde265

Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_weighted_pred_avg_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.

CVE-2022-43242: Heap-buffer-overflow in motion.cc: mc_luma<unsigned char> · Issue #340 · strukturag/libde265

Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_luma<unsigned char> in motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.

CVE-2022-43236: Stack-buffer-overflow in fallback-motion.cc: void put_qpel_fallback<unsigned short> · Issue #343 · strukturag/libde265

Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.

CVE-2022-43240: Heap-buffer-overflow in sse-motion.cc: ff_hevc_put_hevc_qpel_h_2_v_1_sse · Issue #335 · strukturag/libde265

Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_qpel_h_2_v_1_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.

CVE-2022-43252: Heap-buffer-overflow in fallback-motion.cc in put_epel_16_fallback · Issue #347 · strukturag/libde265

Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_16_fallback in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.

CVE-2022-43239: Heap-buffer-overflow in motion.cc: mc_chroma<unsigned short> · Issue #341 · strukturag/libde265

Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_chroma<unsigned short> in motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.

CVE-2022-43235: Heap-buffer-overflow in sse-motion.cc: ff_hevc_put_hevc_epel_pixels_8_sse · Issue #337 · strukturag/libde265

Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_epel_pixels_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.

CVE-2022-43253: Heap-buffer-overflow in fallback-motion.cc: put_unweighted_pred_16_fallback · Issue #348 · strukturag/libde265

Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_unweighted_pred_16_fallback in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.

CVE-2022-43237: Stack-buffer-overflow in fallback-motion.cc: void put_epel_hv_fallback<unsigned short> · Issue #344 · strukturag/libde265

Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via void put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.

CVE-2022-43241: Crash in see-motion.cc: ff_hevc_put_hevc_qpel_v_3_8_sse · Issue #338 · strukturag/libde265

Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_v_3_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.

CVE-2022-1253: Heap-based Buffer Overflow in libde265

Heap-based Buffer Overflow in GitHub repository strukturag/libde265 prior to and including 1.0.8. The fix is established in commit 8e89fe0e175d2870c39486fdd09250b230ec10b8 but does not yet belong to an official release.

CVE-2021-36411: A SEGV has occurred when running program dec265 · Issue #302 · strukturag/libde265

An issue has been found in libde265 v1.0.8 due to incorrect access control. A SEGV caused by a READ memory access in function derive_boundaryStrength of deblock.cc has occurred. The vulnerability causes a segmentation fault and application crash, which leads to remote denial of service.

CVE-2021-36410: stack-buffer-overflow in fallback-motion.cc when decoding file · Issue #301 · strukturag/libde265

A stack-buffer-overflow exists in libde265 v1.0.8 via fallback-motion.cc in function put_epel_hv_fallback when running program dec265.

CVE-2021-36409: There is an Assertion failed at sps.cc · Issue #300 · strukturag/libde265

There is an Assertion `scaling_list_pred_matrix_id_delta==1' failed at sps.cc:925 in libde265 v1.0.8 when decoding file, which allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file or possibly have unspecified other impact.

CVE-2021-36408: Heap-use-after-free in intrapred.h when decoding file · Issue #299 · strukturag/libde265

An issue was discovered in libde265 v1.0.8.There is a Heap-use-after-free in intrapred.h when decoding file using dec265.

CVE-2020-21602: heap-buffer-overflow in put_weighted_bipred_16_fallback when decoding file · Issue #242 · strukturag/libde265

libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_bipred_16_fallback function, which can be exploited via a crafted a file.

CVE-2020-21605: segment fault in apply_sao_internal when decoding file · Issue #234 · strukturag/libde265

libde265 v1.0.4 contains a segmentation fault in the apply_sao_internal function, which can be exploited via a crafted a file.

CVE-2020-21604: heap-buffer-overflow in decode file · Issue #231 · strukturag/libde265

libde265 v1.0.4 contains a heap buffer overflow fault in the _mm_loadl_epi64 function, which can be exploited via a crafted a file.

CVE-2020-21603: heap-buffer-overflow in put_qpel_0_0_fallback_16 when decoding file · Issue #240 · strukturag/libde265

libde265 v1.0.4 contains a heap buffer overflow in the put_qpel_0_0_fallback_16 function, which can be exploited via a crafted a file.

CVE-2020-21606: heap-buffer-overflow in put_epel_16_fallback when decoding file · Issue #232 · strukturag/libde265

libde265 v1.0.4 contains a heap buffer overflow fault in the put_epel_16_fallback function, which can be exploited via a crafted a file.

CVE-2020-21601: stack-buffer-overflow in put_qpel_fallback when decoding file · Issue #241 · strukturag/libde265

libde265 v1.0.4 contains a stack buffer overflow in the put_qpel_fallback function, which can be exploited via a crafted a file.

CVE-2020-21600: heap-buffer-overflow in put_weighted_pred_avg_16_fallback when decoding file · Issue #243 · strukturag/libde265

libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_pred_avg_16_fallback function, which can be exploited via a crafted a file.

CVE-2020-21599: heap overflow in de265_image::available_zscan when decoding file · Issue #235 · strukturag/libde265

libde265 v1.0.4 contains a heap buffer overflow in the de265_image::available_zscan function, which can be exploited via a crafted a file.

CVE-2020-21598: heap-buffer-overflow in ff_hevc_put_unweighted_pred_8_sse when decoding file · Issue #237 · strukturag/libde265

libde265 v1.0.4 contains a heap buffer overflow in the ff_hevc_put_unweighted_pred_8_sse function, which can be exploited via a crafted a file.

CVE-2020-21597: heap-buffer-overflow in mc_chroma when decoding file · Issue #238 · strukturag/libde265

libde265 v1.0.4 contains a heap buffer overflow in the mc_chroma function, which can be exploited via a crafted a file.

CVE-2020-21596: global buffer overflow in decode_CABAC_bit when decoding file · Issue #236 · strukturag/libde265

libde265 v1.0.4 contains a global buffer overflow in the decode_CABAC_bit function, which can be exploited via a crafted a file.

CVE-2020-21595: heap-buffer-overflow in mc_luma when decoding file · Issue #239 · strukturag/libde265

libde265 v1.0.4 contains a heap buffer overflow in the mc_luma function, which can be exploited via a crafted a file.

CVE-2020-21594: heap-buffer-overflow in put_epel_hv_fallback when decoding file · Issue #233 · strukturag/libde265

libde265 v1.0.4 contains a heap buffer overflow in the put_epel_hv_fallback function, which can be exploited via a crafted a file.

Packet Storm: Latest News

Scapy Packet Manipulation Tool 2.6.1