Headline
Debian Security Advisory 5490-1
Debian Linux Security Advisory 5490-1 - Multiple security vulnerabilities have been discovered in aom, the AV1 Video Codec Library. Buffer overflows, use-after-free and NULL pointer dereferences may cause a denial of service or other unspecified impact if a malformed multimedia file is processed.
-----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5490-1 [email protected]://www.debian.org/security/ Markus KoschanySeptember 06, 2023 https://www.debian.org/security/faq- -------------------------------------------------------------------------Package : aomCVE ID : CVE-2020-36130 CVE-2020-36131 CVE-2020-36133 CVE-2020-36135 CVE-2021-30473 CVE-2021-30474 CVE-2021-30475Multiple security vulnerabilities have been discovered in aom, the AV1 VideoCodec Library. Buffer overflows, use-after-free and NULL pointer dereferencesmay cause a denial of service or other unspecified impact if a malformedmultimedia file is processed.For the oldstable distribution (bullseye), these problems have been fixedin version 1.0.0.errata1-3+deb11u1.We recommend that you upgrade your aom packages.For the detailed security status of aom please refer toits security tracker page at:https://security-tracker.debian.org/tracker/aomFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: [email protected] PGP SIGNATURE-----iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmT3rHBfFIAAAAAALgAoaXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFDRjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7UeSTUw//f5aA9QXBT7ro8HZITTZFs0LH6PAc12iyc3ajZDldlKnapdt3d/QmtNyPw/Xv+rG1gY/1/VJg0Id6mEXqpMuuDHQvv3db7QeAn2P/JWK+qnS7o/rxJdtqbtgkuiDQ79AbmCNG6Km7J5pZuvzW7zY5QKcLEwpG0Xzjn+Uf0prtw1nLQU8sVs/MWLFzWxIym8+QT+xwrjj5j5wfXzhmMQJxKLVhn12zV0ZHYJ6RR3eKDKCJNpTkYia+OdQF573X50sStBUrs8DBguRemWfkOdaBnqcDscFX0ody+UWwQ4a7b2PlN8U4cyhEQ92BgEL57afIo9nrIYT4hHKjEWzYKN/O/NGm3bDol2xFlJkiXQvpildPMPNVChpnqudPVz9A78qJDtyJ6P0/VTeLjhB8uJcSMZUoLNXzH4XwObd1uAHow8/tHl32WK+1CdVie1qfCpKscDEL7O+Mn315K3xu6WfQ+volXlsPn+NbDtRsNvnSvbTbEvhBWByr8VpCOG+oMdoHvzqL+4aIA1lL7aioLCBNYH2F4ZQX7DabnLfcpbWWHXqswNAlv5UL+McmDA84RJgGycQS77gbvTsPvYYw+iuGNDVHiI+jtIsAROqwmmwtOXNb61GZLe8JpokAkZClfhja3DOxZE+LaPWPFECxmHlIQRf1Q81h5whD97WNDSgYz8E==vlUG-----END PGP SIGNATURE-----Related news
Gentoo Linux Security Advisory 202401-32 - Multiple vulnerabilities have been discovered in libaom, the worst of which can lead to remote code execution. Versions greater than or equal to 3.2.0 are affected.
Ubuntu Security Notice 6447-1 - It was discovered that AOM incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service.
Hello everyone! Great news for my open source Scanvus project! You can now perform vulnerability checks on Linux hosts and docker images not only using the Vulners.com API, but also with the Vulns.io VM API. It’s especially nice that all the code to support the new API was written and contributed by colleagues from Vulns.io. […]
AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c.
AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.
AOM v2.0.1 was discovered to contain a global buffer overflow via the component av1/encoder/partition_search.h.
AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.
aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow.
aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap.