Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in ffmpeg
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in ffmpeg
ID: SUSE-SU-2018:3609-1
Distribution: SUSE
Plattformen: SUSE Linux Enterprise Module for Desktop Applications 15, SUSE Linux Enterprise Workstation Extension 15, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux Enterprise Module for Packagehub Subpackages 15
Datum: Sa, 3. November 2018, 00:14
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15822
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13300
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12458
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13305
Applikationen: FFmpeg

Originalnachricht

   SUSE Security Update: Security update for ffmpeg
______________________________________________________________________________

Announcement ID: SUSE-SU-2018:3609-1
Rating: moderate
References: #1097983 #1100345 #1100348 #1105869
Cross-References: CVE-2018-12458 CVE-2018-13300 CVE-2018-13305
CVE-2018-15822
Affected Products:
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Module for Packagehub Subpackages 15
SUSE Linux Enterprise Module for Open Buildservice
Development Tools 15
SUSE Linux Enterprise Module for Desktop Applications 15
______________________________________________________________________________

An update that fixes four vulnerabilities is now available.

Description:

This update for ffmpeg fixes the following issues:

- CVE-2018-13300: An improper argument passed to the avpriv_request_sample
function may have triggered an out-of-array read while converting a
crafted AVI file to MPEG4, leading to a denial of service and possibly
an information disclosure (bsc#1100348)
- CVE-2018-15822: The flv_write_packet function did not check for an empty
audio packet, leading to an assertion failure and DoS (bsc#1105869)
- CVE-2018-13305: Due to a missing check for negative values of the mquant
variable, the vc1_put_blocks_clamped function in libavcodec/vc1_block.c
may trigger an out-of-array access while converting a crafted AVI file
to MPEG4, leading to an information disclosure or a denial of service.
(bsc#1100345).
- CVE-2018-12458: An improper integer type in the mpeg4_encode_gop_header
function in libavcodec/mpeg4videoenc.c might have triggered an assertion
violation while converting a crafted AVI file to MPEG4, leading to a
denial of service. (bsc#1097983).


Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- SUSE Linux Enterprise Workstation Extension 15:

zypper in -t patch SUSE-SLE-Product-WE-15-2018-2566=1

- SUSE Linux Enterprise Module for Packagehub Subpackages 15:

zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-2018-2566=1

- SUSE Linux Enterprise Module for Open Buildservice Development Tools 15:

zypper in -t patch SUSE-SLE-Module-Development-Tools-OBS-15-2018-2566=1

- SUSE Linux Enterprise Module for Desktop Applications 15:

zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-2018-2566=1



Package List:

- SUSE Linux Enterprise Workstation Extension 15 (x86_64):

ffmpeg-debuginfo-3.4.2-4.12.4
ffmpeg-debugsource-3.4.2-4.12.4
libavcodec-devel-3.4.2-4.12.4
libavformat-devel-3.4.2-4.12.4
libavformat57-3.4.2-4.12.4
libavformat57-debuginfo-3.4.2-4.12.4
libavresample-devel-3.4.2-4.12.4
libavresample3-3.4.2-4.12.4
libavresample3-debuginfo-3.4.2-4.12.4

- SUSE Linux Enterprise Module for Packagehub Subpackages 15 (aarch64
ppc64le s390x x86_64):

ffmpeg-3.4.2-4.12.4
ffmpeg-debuginfo-3.4.2-4.12.4
ffmpeg-debugsource-3.4.2-4.12.4
libavdevice57-3.4.2-4.12.4
libavdevice57-debuginfo-3.4.2-4.12.4
libavfilter6-3.4.2-4.12.4
libavfilter6-debuginfo-3.4.2-4.12.4

- SUSE Linux Enterprise Module for Open Buildservice Development Tools 15
(aarch64 ppc64le s390x x86_64):

ffmpeg-3.4.2-4.12.4
ffmpeg-debuginfo-3.4.2-4.12.4
ffmpeg-debugsource-3.4.2-4.12.4
ffmpeg-private-devel-3.4.2-4.12.4
libavdevice-devel-3.4.2-4.12.4
libavdevice57-3.4.2-4.12.4
libavdevice57-debuginfo-3.4.2-4.12.4
libavfilter-devel-3.4.2-4.12.4
libavfilter6-3.4.2-4.12.4
libavfilter6-debuginfo-3.4.2-4.12.4

- SUSE Linux Enterprise Module for Desktop Applications 15 (aarch64 ppc64le
s390x x86_64):

ffmpeg-debuginfo-3.4.2-4.12.4
ffmpeg-debugsource-3.4.2-4.12.4
libavcodec57-3.4.2-4.12.4
libavcodec57-debuginfo-3.4.2-4.12.4
libavutil-devel-3.4.2-4.12.4
libavutil55-3.4.2-4.12.4
libavutil55-debuginfo-3.4.2-4.12.4
libpostproc-devel-3.4.2-4.12.4
libpostproc54-3.4.2-4.12.4
libpostproc54-debuginfo-3.4.2-4.12.4
libswresample-devel-3.4.2-4.12.4
libswresample2-3.4.2-4.12.4
libswresample2-debuginfo-3.4.2-4.12.4
libswscale-devel-3.4.2-4.12.4
libswscale4-3.4.2-4.12.4
libswscale4-debuginfo-3.4.2-4.12.4


References:

https://www.suse.com/security/cve/CVE-2018-12458.html
https://www.suse.com/security/cve/CVE-2018-13300.html
https://www.suse.com/security/cve/CVE-2018-13305.html
https://www.suse.com/security/cve/CVE-2018-15822.html
https://bugzilla.suse.com/1097983
https://bugzilla.suse.com/1100345
https://bugzilla.suse.com/1100348
https://bugzilla.suse.com/1105869

_______________________________________________
sle-security-updates mailing list
sle-security-updates@lists.suse.com
http://lists.suse.com/mailman/listinfo/sle-security-updates
Pro-Linux
Unterstützer werden
Neue Nachrichten
Werbung