drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in ffmpeg
Name: |
Mehrere Probleme in ffmpeg |
|
ID: |
SUSE-SU-2018:3609-1 |
|
Distribution: |
SUSE |
|
Plattformen: |
SUSE Linux Enterprise Module for Desktop Applications 15, SUSE Linux Enterprise Workstation Extension 15, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux Enterprise Module for Packagehub Subpackages 15 |
|
Datum: |
Sa, 3. November 2018, 00:14 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15822
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13300
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12458
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13305 |
|
Applikationen: |
FFmpeg |
|
Originalnachricht |
SUSE Security Update: Security update for ffmpeg ______________________________________________________________________________
Announcement ID: SUSE-SU-2018:3609-1 Rating: moderate References: #1097983 #1100345 #1100348 #1105869 Cross-References: CVE-2018-12458 CVE-2018-13300 CVE-2018-13305 CVE-2018-15822 Affected Products: SUSE Linux Enterprise Workstation Extension 15 SUSE Linux Enterprise Module for Packagehub Subpackages 15 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SUSE Linux Enterprise Module for Desktop Applications 15 ______________________________________________________________________________
An update that fixes four vulnerabilities is now available.
Description:
This update for ffmpeg fixes the following issues:
- CVE-2018-13300: An improper argument passed to the avpriv_request_sample function may have triggered an out-of-array read while converting a crafted AVI file to MPEG4, leading to a denial of service and possibly an information disclosure (bsc#1100348) - CVE-2018-15822: The flv_write_packet function did not check for an empty audio packet, leading to an assertion failure and DoS (bsc#1105869) - CVE-2018-13305: Due to a missing check for negative values of the mquant variable, the vc1_put_blocks_clamped function in libavcodec/vc1_block.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to an information disclosure or a denial of service. (bsc#1100345). - CVE-2018-12458: An improper integer type in the mpeg4_encode_gop_header function in libavcodec/mpeg4videoenc.c might have triggered an assertion violation while converting a crafted AVI file to MPEG4, leading to a denial of service. (bsc#1097983).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Workstation Extension 15:
zypper in -t patch SUSE-SLE-Product-WE-15-2018-2566=1
- SUSE Linux Enterprise Module for Packagehub Subpackages 15:
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-2018-2566=1
- SUSE Linux Enterprise Module for Open Buildservice Development Tools 15:
zypper in -t patch SUSE-SLE-Module-Development-Tools-OBS-15-2018-2566=1
- SUSE Linux Enterprise Module for Desktop Applications 15:
zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-2018-2566=1
Package List:
- SUSE Linux Enterprise Workstation Extension 15 (x86_64):
ffmpeg-debuginfo-3.4.2-4.12.4 ffmpeg-debugsource-3.4.2-4.12.4 libavcodec-devel-3.4.2-4.12.4 libavformat-devel-3.4.2-4.12.4 libavformat57-3.4.2-4.12.4 libavformat57-debuginfo-3.4.2-4.12.4 libavresample-devel-3.4.2-4.12.4 libavresample3-3.4.2-4.12.4 libavresample3-debuginfo-3.4.2-4.12.4
- SUSE Linux Enterprise Module for Packagehub Subpackages 15 (aarch64 ppc64le s390x x86_64):
ffmpeg-3.4.2-4.12.4 ffmpeg-debuginfo-3.4.2-4.12.4 ffmpeg-debugsource-3.4.2-4.12.4 libavdevice57-3.4.2-4.12.4 libavdevice57-debuginfo-3.4.2-4.12.4 libavfilter6-3.4.2-4.12.4 libavfilter6-debuginfo-3.4.2-4.12.4
- SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (aarch64 ppc64le s390x x86_64):
ffmpeg-3.4.2-4.12.4 ffmpeg-debuginfo-3.4.2-4.12.4 ffmpeg-debugsource-3.4.2-4.12.4 ffmpeg-private-devel-3.4.2-4.12.4 libavdevice-devel-3.4.2-4.12.4 libavdevice57-3.4.2-4.12.4 libavdevice57-debuginfo-3.4.2-4.12.4 libavfilter-devel-3.4.2-4.12.4 libavfilter6-3.4.2-4.12.4 libavfilter6-debuginfo-3.4.2-4.12.4
- SUSE Linux Enterprise Module for Desktop Applications 15 (aarch64 ppc64le s390x x86_64):
ffmpeg-debuginfo-3.4.2-4.12.4 ffmpeg-debugsource-3.4.2-4.12.4 libavcodec57-3.4.2-4.12.4 libavcodec57-debuginfo-3.4.2-4.12.4 libavutil-devel-3.4.2-4.12.4 libavutil55-3.4.2-4.12.4 libavutil55-debuginfo-3.4.2-4.12.4 libpostproc-devel-3.4.2-4.12.4 libpostproc54-3.4.2-4.12.4 libpostproc54-debuginfo-3.4.2-4.12.4 libswresample-devel-3.4.2-4.12.4 libswresample2-3.4.2-4.12.4 libswresample2-debuginfo-3.4.2-4.12.4 libswscale-devel-3.4.2-4.12.4 libswscale4-3.4.2-4.12.4 libswscale4-debuginfo-3.4.2-4.12.4
References:
https://www.suse.com/security/cve/CVE-2018-12458.html https://www.suse.com/security/cve/CVE-2018-13300.html https://www.suse.com/security/cve/CVE-2018-13305.html https://www.suse.com/security/cve/CVE-2018-15822.html https://bugzilla.suse.com/1097983 https://bugzilla.suse.com/1100345 https://bugzilla.suse.com/1100348 https://bugzilla.suse.com/1105869
_______________________________________________ sle-security-updates mailing list sle-security-updates@lists.suse.com http://lists.suse.com/mailman/listinfo/sle-security-updates
|
|
|
|