openSUSE-SU-2016:1685

75932

USN-2944-1

https://blogs.gentoo.org/ago/2015/07/16/libav-divide-by-zero-in-ff_h263_decode_mba/

https://git.libav.org/?p=libav.git;a=commitdiff;h=0a49a62f998747cfa564d98d36a459fe70d3299b

https://libav.org/releases/libav-11.5.changelog

Multiple vulnerabilities have been found in libav :

CVE-2015-1872

The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in Libav before 0.8.18 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Motion JPEG data.

CVE-2015-5479

The ff_h263_decode_mba function in libavcodec/ituh263dec.c in Libav before 11.5 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a file with crafted dimensions.

CVE-2016-7393

The aac_sync function in libavcodec/aac_parser.c in Libav before 11.5 is vulnerable to a stack-based buffer overflow.

For Debian 7 'Wheezy', these problems have been fixed in version 6:0.8.18-0+deb7u1.

We recommend that you upgrade your libav packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libav fixes the two following security issues :

  - CVE-2016-3062: A MP4 memory corruption was fixed that     could lead to crashes or code execution. (boo#984487)

  - CVE-2015-5479: A crash due to a divide by zero was fixed     in ff_h263_decode_mba() that could lead to decoder     crashes. (boo#949760)

It was discovered that Libav incorrectly handled certain malformed media files. If a user were tricked into opening a crafted media file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Agostino Sarubbo reports :

libav: divide-by-zero in ff_h263_decode_mba()

ID	Name	Product	Family	Severity
93847	Debian DLA-644-1 : libav security update	Nessus	Debian Local Security Checks	medium
91870	openSUSE Security Update : libav (openSUSE-2016-779)	Nessus	SuSE Local Security Checks	high
90349	Ubuntu 12.04 LTS : libav vulnerabilities (USN-2944-1)	Nessus	Ubuntu Local Security Checks	high
84815	FreeBSD : libav -- divide by zero (a928960a-2bdc-11e5-86ff-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium

CVE-2015-5479

medium

Tenable Plugins

medium

high

high

medium