Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_prediction function at motion.cc.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the
    derive_spatial_luma_vector_prediction function at motion.cc. (CVE-2023-49465)

  - Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the
    derive_combined_bipredictive_merging_candidates function at motion.cc. (CVE-2023-49467)

  - Libde265 v1.0.14 was discovered to contain a global buffer overflow vulnerability in the read_coding_unit
    function at slice.cc. (CVE-2023-49468)

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3699 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3699-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     December 30, 2023                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libde265     Version        : 1.0.11-0+deb10u6     CVE ID         : CVE-2023-49465 CVE-2023-49467 CVE-2023-49468


    Three issues have been found in libde265, an open H.265 video codec     implementation. All issues are related to heap-buffer-overflow or global     buffer overflow in different functions.



    For Debian 10 buster, these problems have been fixed in version     1.0.11-0+deb10u6.

    We recommend that you upgrade your libde265 packages.

    For the detailed security status of libde265 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libde265

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6677-1 advisory.

    It was discovered that libde265 could be made to dereference invalid memory. If a user or automated system     were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a     denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-27102)

    It was discovered that libde265 could be made to write out of bounds. If a user or automated system were     tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial     of service or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu     20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-27103)

    It was discovered that libde265 could be made to write out of bounds. If a user or automated system were     tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial     of service or execute arbitrary code. (CVE-2023-43887, CVE-2023-47471, CVE-2023-49465, CVE-2023-49467,     CVE-2023-49468)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
424033	Alpine: multiple libde265 packages: security update to 1.0.15-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
424033	Alpine: multiple libde265 packages: security update to 1.0.15-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
214467	Debian dla-3699 : libde265-0 - security update	Nessus	Debian Local Security Checks	high
191560	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : libde265 vulnerabilities (USN-6677-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2023-49465

high

Tenable Plugins

high

high

high

high