The swri_audio_convert function in audioconvert.c in FFmpeg libswresample through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6, and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The swri_audio_convert function in audioconvert.c in FFmpeg libswresample through 3.0.101, as used in     FFmpeg 3.4.1, aubio 0.4.6, and other products, allows remote attackers to cause a denial of service (NULL     pointer dereference and application crash) via a crafted audio file. (CVE-2017-17555)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for ffmpeg-4 fixes the following issues :

ffmpeg-4 was updated to version 4.0.5, fixes boo#1133153 

  - CVE-2019-11339: The studio profile decoder in     libavcodec/mpeg4videodec.c in FFmpeg 4.0 allowed remote     attackers to cause a denial of service (out-of-array     access) or possibly have unspecified. (bsc#1133153)

  - For other changes see     /usr/share/doc/packages/libavcodec58/Changelog

Update to version 4.2.1 :

  - Stable bug fix release, mainly codecs and format fixes.

  - CVE-2019-15942: Conditional jump or move depends on     uninitialised value' issue in h2645_parse (boo#1149839)

Update to FFmpeg 4.2 'Ada'

  - tpad filter

  - AV1 decoding support through libdav1d

  - dedot filter

  - chromashift and rgbashift filters

  - freezedetect filter

  - truehd_core bitstream filter

  - dhav demuxer

  - PCM-DVD encoder

  - GIF parser

  - vividas demuxer

  - hymt decoder

  - anlmdn filter

  - maskfun filter

  - hcom demuxer and decoder

  - ARBC decoder

  - libaribb24 based ARIB STD-B24 caption support (profiles     A and C)

  - Support decoding of HEVC 4:4:4 content in nvdec and     cuviddec

  - removed libndi-newtek

  - agm decoder

  - KUX demuxer

  - AV1 frame split bitstream filter

  - lscr decoder

  - lagfun filter

  - asoftclip filter

  - Support decoding of HEVC 4:4:4 content in vdpau

  - colorhold filter

  - xmedian filter

  - asr filter

  - showspatial multimedia filter

  - VP4 video decoder

  - IFV demuxer

  - derain filter

  - deesser filter

  - mov muxer writes tracks with unspecified language     instead of English by default

  - added support for using clang to compile CUDA kernels

  - See /usr/share/doc/packages/ffmpeg-4/Changelog for the     complete changelog.

Update to version 4.1.4

  - See /usr/share/doc/packages/ffmpeg-4/Changelog for the     complete changelog.

  - Enable runtime enabling for fdkaac via
    --enable-libfdk-aac-dlopen

Update to version 4.1.3 :

  - Updates and bug fixes for codecs, filters and formats.
    [boo#1133153, boo#1133155, CVE-2019-11338,     CVE-2019-11339]

Update to version 4.1.2 :

  - Updates and bug fixes for codecs, filters and formats.

Update to version 4.1.1 :

  - Various filter and codec fixes and enhancements.

  - configure: Add missing xlib dependency for VAAPI X11     code.

  - For complete changelog, see     /usr/share/doc/packages/ffmpeg-4/Changelog

  - enable AV1 support on x86_64

Update ffmpeg to 4.1 :

  - Lots of filter updates as usual: deblock, tmix, aplify,     fftdnoiz, aderivative, aintegral, pal75bars, pal100bars,     adeclick, adeclip, lensfun (wrapper), colorconstancy, 1D     LUT filter (lut1d), cue, acue, transpose_npp, amultiply,     Block-Matching 3d (bm3d) denoising filter, acrossover     filter, audio denoiser as afftdn filter, sinc audio     filter source, chromahold, setparams, vibrance, xstack,     (a)graphmonitor filter yadif_cuda filter.

  - AV1 parser

  - Support for AV1 in MP4

  - PCM VIDC decoder and encoder

  - libtensorflow backend for DNN based filters like srcnn

  - -- The following only enabled in third-party builds :

  - ATRAC9 decoder

  - AVS2 video decoder via libdavs2

  - IMM4 video decoder

  - Brooktree ProSumer video decoder

  - MatchWare Screen Capture Codec decoder

  - WinCam Motion Video decoder

  - RemotelyAnywhere Screen Capture decoder

  - AVS2 video encoder via libxavs2

  - ILBC decoder

  - SER demuxer

  - Decoding S12M timecode in H264

  - For complete changelog, see     https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n4.1

Update ffmpeg to 4.0.3 :

  - For complete changelog, see     https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n4.0.3

  - CVE-2018-13305: Added a missing check for negative     values of mqaunt variable (boo#1100345).

This update for ffmpeg fixes the following issues :

Updated ffmpeg to new bugfix release 3.4.2

  - Fix integer overflows, multiplication overflows,     undefined shifts, and verify buffer lengths.

  - avfilter/vf_transpose: Fix used plane count     [boo#1078488, CVE-2018-6392]

  - avcodec/utvideodec: Fix bytes left check in     decode_frame() [boo#1079368, CVE-2018-6621] 

  - Enable use of libzvbi for displaying teletext subtitles.

  - Fixed a DoS in swri_audio_convert() [boo#1072366,     CVE-2017-17555].

Update to new bugfix release 3.4.1

  - Fixed integer overflows, division by zero, illegal bit     shifts

  - Fixed the gmc_mmx function which failed to validate     width and height [boo#1070762, CVE-2017-17081]

  - Fixed out-of-bounds in VC-2 encoder [boo#1069407,     CVE-2017-16840]

  - ffplay: use SDL2 audio API

  - install also doc/ffserver.conf

  - Update to new upstream release 3.4

  - New video filters: deflicker, doublewave, lumakey,     pixscope, oscilloscope, robterts, limiter, libvmaf,     unpremultiply, tlut2, floodifll, pseudocolor, despill,     convolve, vmafmotion.

  - New audio filters: afir, crossfeed, surround, headphone,     superequalizer, haas.

  - Some video filters with several inputs now use a common     set of options: blend, libvmaf, lut3d, overlay, psnr,     ssim. They must always be used by name.

  - librsvg support for svg rasterization

  - spec-compliant VP9 muxing support in MP4

  - Remove the libnut and libschroedinger muxer/demuxer     wrappers

  - drop deprecated qtkit input device (use avfoundation     instead)

  - SUP/PGS subtitle muxer

  - VP9 tile threading support

  - KMS screen grabber

  - CUDA thumbnail filter

  - V4L2 mem2mem HW assisted codecs

  - Rockchip MPP hardware decoding

  - (Not in openSUSE builds, only original ones:)

  - Gremlin Digital Video demuxer and decoder

  - Additional frame format support for Interplay MVE movies

  - Dolby E decoder and SMPTE 337M demuxer

  - raw G.726 muxer and demuxer, left- and right-justified

  - NewTek NDI input/output device

  - FITS demuxer, muxer, decoder and encoder

  - Fixed a double free in huffyuv [boo#1064577,     CVE-2017-15186]

  - Fixed an out-of-bounds in ffv1dec [boo#1066428,     CVE-2017-15672]

ID	Name	Product	Family	Severity
254257	Linux Distros Unpatched Vulnerability : CVE-2017-17555	Nessus	Misc.	medium
132910	openSUSE Security Update : ffmpeg-4 (openSUSE-2020-24)	Nessus	SuSE Local Security Checks	high
106890	openSUSE Security Update : ffmpeg (openSUSE-2018-172)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2017-17555

medium

Tenable Plugins

medium

high

critical