Libde265 1.0.9 is vulnerable to Buffer Overflow in function void put_qpel_fallback<unsigned short>

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - libde265 v1.0.4 contains a heap buffer overflow in the ff_hevc_put_unweighted_pred_8_sse function, which
    can be exploited via a crafted a file. (CVE-2020-21598)

  - libde265 v1.0.4 contains a heap buffer overflow in the put_epel_hv_fallback function, which can be
    exploited via a crafted a file. (CVE-2020-21594)

  - libde265 v1.0.4 contains a heap buffer overflow in the mc_luma function, which can be exploited via a
    crafted a file. (CVE-2020-21595)

  - libde265 v1.0.4 contains a global buffer overflow in the decode_CABAC_bit function, which can be exploited
    via a crafted a file. (CVE-2020-21596)

  - libde265 v1.0.4 contains a heap buffer overflow in the mc_chroma function, which can be exploited via a
    crafted a file. (CVE-2020-21597)

The remote host is affected by the vulnerability described in GLSA-202408-20 (libde265: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in libde265. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 421c0af9-b206-11ed-9fe5-f4a47516fb57 advisory.

  - libde265 v1.0.4 contains a heap buffer overflow in the put_epel_hv_fallback function, which can be     exploited via a crafted a file. (CVE-2020-21594)

  - libde265 v1.0.4 contains a heap buffer overflow in the mc_luma function, which can be exploited via a     crafted a file. (CVE-2020-21595)

  - libde265 v1.0.4 contains a global buffer overflow in the decode_CABAC_bit function, which can be exploited     via a crafted a file. (CVE-2020-21596)

  - libde265 v1.0.4 contains a heap buffer overflow in the mc_chroma function, which can be exploited via a     crafted a file. (CVE-2020-21597)

  - libde265 v1.0.4 contains a heap buffer overflow in the ff_hevc_put_unweighted_pred_8_sse function, which     can be exploited via a crafted a file. (CVE-2020-21598)

  - libde265 v1.0.4 contains a heap buffer overflow in the de265_image::available_zscan function, which can be     exploited via a crafted a file. (CVE-2020-21599)

  - libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_pred_avg_16_fallback function, which     can be exploited via a crafted a file. (CVE-2020-21600)

  - libde265 v1.0.4 contains a stack buffer overflow in the put_qpel_fallback function, which can be exploited     via a crafted a file. (CVE-2020-21601)

  - libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_bipred_16_fallback function, which can     be exploited via a crafted a file. (CVE-2020-21602)

  - libde265 v1.0.4 contains a heap buffer overflow in the put_qpel_0_0_fallback_16 function, which can be     exploited via a crafted a file. (CVE-2020-21603)

  - libde265 v1.0.4 contains a heap buffer overflow fault in the _mm_loadl_epi64 function, which can be     exploited via a crafted a file. (CVE-2020-21604)

  - libde265 v1.0.4 contains a segmentation fault in the apply_sao_internal function, which can be exploited     via a crafted a file. (CVE-2020-21605)

  - libde265 v1.0.4 contains a heap buffer overflow fault in the put_epel_16_fallback function, which can be     exploited via a crafted a file. (CVE-2020-21606)

  - Heap-based Buffer Overflow in GitHub repository strukturag/libde265 prior to and including 1.0.8. The fix     is established in commit 8e89fe0e175d2870c39486fdd09250b230ec10b8 but does not yet belong to an official     release. (CVE-2022-1253)

  - Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via     put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43236)

  - Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via void     put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43237)

  - Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_h_3_v_3_sse in sse-     motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video     file. (CVE-2022-43238)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_chroma<unsigned     short> in motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted     video file. (CVE-2022-43239)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     ff_hevc_put_hevc_qpel_h_2_v_1_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial     of Service (DoS) via a crafted video file. (CVE-2022-43240)

  - Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_v_3_8_sse in sse-     motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video     file. (CVE-2022-43241)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_luma<unsigned char>     in motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video     file. (CVE-2022-43242)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     ff_hevc_put_weighted_pred_avg_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43243)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43244)

  - Libde265 v1.0.8 was discovered to contain a segmentation violation via apply_sao_internal<unsigned short>     in sao.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video     file. (CVE-2022-43245)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     put_weighted_pred_avg_16_fallback in fallback-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43248)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43249)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     put_qpel_0_0_fallback_16 in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of     Service (DoS) via a crafted video file. (CVE-2022-43250)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_16_fallback in     fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted     video file. (CVE-2022-43252)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     put_unweighted_pred_16_fallback in fallback-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43253)

  - Libde265 1.0.9 is vulnerable to Buffer Overflow in function void put_qpel_fallback<unsigned short>     (CVE-2022-47655)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5346 advisory.

    Multiple security issues were discovered in libde265, an implementation of the H.265 video codec which may     result in denial of service and potentially the execution of arbitrary code if a malformed media file is     processed. For the stable distribution (bullseye), these problems have been fixed in version     1.0.11-0+deb11u1. We recommend that you upgrade your libde265 packages. For the detailed security status     of libde265 please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/libde265

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3280 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3280-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     January 24, 2023                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libde265     Version        : 1.0.3-1+deb10u2     CVE ID         : CVE-2020-21596 CVE-2020-21597 CVE-2020-21598 CVE-2022-43235                      CVE-2022-43236 CVE-2022-43237 CVE-2022-43238 CVE-2022-43239                      CVE-2022-43240 CVE-2022-43241 CVE-2022-43242 CVE-2022-43243                      CVE-2022-43244 CVE-2022-43245 CVE-2022-43248 CVE-2022-43249                      CVE-2022-43250 CVE-2022-43252 CVE-2022-43253 CVE-2022-47655     Debian Bug     : 1025816 1027179 1029357 1029397

    Multiple issues were found in libde265, an open source implementation     of the H.265 video codec, which may result in denial of service or have     unspecified other impact.


    CVE-2020-21596

        libde265 v1.0.4 contains a global buffer overflow in the         decode_CABAC_bit function, which can be exploited via a crafted a         file.

    CVE-2020-21597

        libde265 v1.0.4 contains a heap buffer overflow in the mc_chroma         function, which can be exploited via a crafted a file.

    CVE-2020-21598

        libde265 v1.0.4 contains a heap buffer overflow in the         ff_hevc_put_unweighted_pred_8_sse function, which can be exploited         via a crafted a file.

    CVE-2022-43235

        Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow         vulnerability via ff_hevc_put_hevc_epel_pixels_8_sse in         sse-motion.cc. This vulnerability allows attackers to cause a Denial         of Service (DoS) via a crafted video file.

    CVE-2022-43236

        Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow         vulnerability via put_qpel_fallback<unsigned short> in         fallback-motion.cc. This vulnerability allows attackers to cause a         Denial of Service (DoS) via a crafted video file.

    CVE-2022-43237

        Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow         vulnerability via void put_epel_hv_fallback<unsigned short> in         fallback-motion.cc. This vulnerability allows attackers to cause a         Denial of Service (DoS) via a crafted video file.

    CVE-2022-43238

        Libde265 v1.0.8 was discovered to contain an unknown crash via         ff_hevc_put_hevc_qpel_h_3_v_3_sse in sse-motion.cc. This         vulnerability allows attackers to cause a Denial of Service (DoS)         via a crafted video file.

    CVE-2022-43239

        Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow         vulnerability via mc_chroma<unsigned short> in motion.cc. This         vulnerability allows attackers to cause a Denial of Service (DoS)         via a crafted video file.

    CVE-2022-43240

        Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow         vulnerability via ff_hevc_put_hevc_qpel_h_2_v_1_sse in         sse-motion.cc. This vulnerability allows attackers to cause a Denial         of Service (DoS) via a crafted video file.

    CVE-2022-43241

        Libde265 v1.0.8 was discovered to contain an unknown crash via         ff_hevc_put_hevc_qpel_v_3_8_sse in sse-motion.cc. This vulnerability         allows attackers to cause a Denial of Service (DoS) via a crafted         video file.

    CVE-2022-43242

        Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow         vulnerability via mc_luma<unsigned char> in motion.cc. This         vulnerability allows attackers to cause a Denial of Service (DoS)         via a crafted video file.

    CVE-2022-43243

        Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow         vulnerability via ff_hevc_put_weighted_pred_avg_8_sse in         sse-motion.cc. This vulnerability allows attackers to cause a Denial         of Service (DoS) via a crafted video file.

    CVE-2022-43244

        Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow         vulnerability via put_qpel_fallback<unsigned short> in         fallback-motion.cc. This vulnerability allows attackers to cause a         Denial of Service (DoS) via a crafted video file.

    CVE-2022-43245

        Libde265 v1.0.8 was discovered to contain a segmentation violation         via apply_sao_internal<unsigned short> in sao.cc. This vulnerability         allows attackers to cause a Denial of Service (DoS) via a crafted         video file.

    CVE-2022-43248

        Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow         vulnerability via put_weighted_pred_avg_16_fallback in         fallback-motion.cc. This vulnerability allows attackers to cause a         Denial of Service (DoS) via a crafted video file.

    CVE-2022-43249

        Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow         vulnerability via put_epel_hv_fallback<unsigned short> in         fallback-motion.cc.  This vulnerability allows attackers to cause a         Denial of Service (DoS) via a crafted video file.

    CVE-2022-43250

        Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow         vulnerability via put_qpel_0_0_fallback_16 in fallback-motion.cc.
        This vulnerability allows attackers to cause a Denial of Service         (DoS) via a crafted video file.

    CVE-2022-43252

        Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow         vulnerability via put_epel_16_fallback in fallback-motion.cc. This         vulnerability allows attackers to cause a Denial of Service (DoS)         via a crafted video file.

    CVE-2022-43253

        Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow         vulnerability via put_unweighted_pred_16_fallback in         fallback-motion.cc. This vulnerability allows attackers to cause a         Denial of Service (DoS) via a crafted video file.

    CVE-2022-47655

        Libde265 1.0.9 is vulnerable to Buffer Overflow in function void         put_qpel_fallback<unsigned short>

    For Debian 10 buster, these problems have been fixed in version     1.0.3-1+deb10u2.

    We recommend that you upgrade your libde265 packages.

    For the detailed security status of libde265 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libde265

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
424031	Alpine: multiple libde265 packages: security update to 1.0.11-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
424031	Alpine: multiple libde265 packages: security update to 1.0.11-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
205344	GLSA-202408-20 : libde265: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
171744	FreeBSD : libde256 -- multiple vulnerabilities (421c0af9-b206-11ed-9fe5-f4a47516fb57)	Nessus	FreeBSD Local Security Checks	critical
171376	Debian DSA-5346-1 : libde265 - security update	Nessus	Debian Local Security Checks	critical
170563	Debian dla-3280 : libde265-0 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2022-47655

high

Tenable Plugins

high

high

critical

critical

critical

high