Mandriva Linux Security Advisory : ffmpeg (MDVSA-2015:173)

This script is Copyright (C) 2015 Tenable Network Security, Inc.


Synopsis :

The remote Mandriva Linux host is missing one or more security
updates.

Description :

Updated ffmpeg packages fix security vulnerabilities :

The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before
2.0.4 does not properly validate a certain bits-per-sample value,
which allows remote attackers to cause a denial of service
(out-of-bounds array access) or possibly have unspecified other impact
via crafted TAK (aka Tom's lossless Audio Kompressor) data
(CVE-2014-2097).

libavcodec/wmalosslessdec.c in FFmpeg before 2.0.4 uses an incorrect
data-structure size for certain coefficients, which allows remote
attackers to cause a denial of service (memory corruption) or possibly
have unspecified other impact via crafted WMA data (CVE-2014-2098).

The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before
2.0.4 does not properly calculate line sizes, which allows remote
attackers to cause a denial of service (out-of-bounds array access) or
possibly have unspecified other impact via crafted Microsoft RLE video
data (CVE-2014-2099).

The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB)
muxer (libavformat/mpegtsenc.c) in FFmpeg before 2.0.4 allows remote
attackers to have unspecified impact and vectors, which trigger an
out-of-bounds write (CVE-2014-2263).

An integer overflow in LZO decompression in FFmpeg before 2.0.5 allows
remote attackers to have an unspecified impact by embedding compressed
data in a video file (CVE-2014-4610).

A heap-based buffer overflow in the encode_slice function in
libavcodec/proresenc_kostya.c in FFmpeg before 2.0.6 can cause a
crash, allowing a malicious image file to cause a denial of service
(CVE-2014-5271).

libavcodec/iff.c in FFmpeg before 2.0.6 allows an attacker to have an
unspecified impact via a crafted iff image, which triggers an
out-of-bounds array access, related to the rgb8 and rgbn formats
(CVE-2014-5272).

libavcodec/mjpegdec.c in FFmpeg before 2.0.6 considers only dimension
differences, and not bits-per-pixel differences, when determining
whether an image size has changed, which allows remote attackers to
cause a denial of service (out-of-bounds access) or possibly have
unspecified other impact via crafted MJPEG data (CVE-2014-8541).

libavcodec/utils.c in FFmpeg before 2.0.6 omits a certain codec ID
during enforcement of alignment, which allows remote attackers to
cause a denial of service (out-of-bounds access) or possibly have
unspecified other impact via crafted JV data (CVE-2014-8542).

libavcodec/mmvideo.c in FFmpeg before 2.0.6 does not consider all
lines of HHV Intra blocks during validation of image height, which
allows remote attackers to cause a denial of service (out-of-bounds
access) or possibly have unspecified other impact via crafted MM video
data (CVE-2014-8543).

libavcodec/tiff.c in FFmpeg before 2.0.6 does not properly validate
bits-per-pixel fields, which allows remote attackers to cause a denial
of service (out-of-bounds access) or possibly have unspecified other
impact via crafted TIFF data (CVE-2014-8544).

libavcodec/pngdec.c in FFmpeg before 2.0.6 accepts the
monochrome-black format without verifying that the bits-per-pixel
value is 1, which allows remote attackers to cause a denial of service
(out-of-bounds access) or possibly have unspecified other impact via
crafted PNG data (CVE-2014-8545).

Integer underflow in libavcodec/cinepak.c in FFmpeg before 2.0.6
allows remote attackers to cause a denial of service (out-of-bounds
access) or possibly have unspecified other impact via crafted Cinepak
video data (CVE-2014-8546).

libavcodec/gifdec.c in FFmpeg before 2.0.6 does not properly compute
image heights, which allows remote attackers to cause a denial of
service (out-of-bounds access) or possibly have unspecified other
impact via crafted GIF data (CVE-2014-8547).

Off-by-one error in libavcodec/smc.c in FFmpeg before 2.0.6 allows
remote attackers to cause a denial of service (out-of-bounds access)
or possibly have unspecified other impact via crafted Quicktime
Graphics (aka SMC) video data (CVE-2014-8548).

This updates provides ffmpeg version 2.0.6, which fixes these issues
and several other bugs which were corrected upstream.

See also :

http://advisories.mageia.org/MGASA-2014-0280.html
http://advisories.mageia.org/MGASA-2014-0464.html

Solution :

Update the affected packages.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now