FreeBSD : ffmpeg -- multiple vulnerabilities (b0da85af-21a3-4c15-a137-fe9e4bc86002)

This script is Copyright (C) 2015 Tenable Network Security, Inc.


Synopsis :

The remote FreeBSD host is missing one or more security-related
updates.

Description :

NVD reports :

The update_dimensions function in libavcodec/vp8.c in FFmpeg through
2.8.1, as used in Google Chrome before 46.0.2490.71 and other
products, relies on a coefficient-partition count during
multi-threaded operation, which allows remote attackers to cause a
denial of service (race condition and memory corruption) or possibly
have unspecified other impact via a crafted WebM file.

The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg
before 2.8.2 omits certain width and height checks, which allows
remote attackers to cause a denial of service (out-of-bounds array
access) or possibly have unspecified other impact via crafted MJPEG
data.

The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg
before 2.8.2 does not validate the Chroma Format Indicator, which
allows remote attackers to cause a denial of service (out-of-bounds
array access) or possibly have unspecified other impact via crafted
High Efficiency Video Coding (HEVC) data.

The decode_uncompressed function in libavcodec/faxcompr.c in FFmpeg
before 2.8.2 does not validate uncompressed runs, which allows remote
attackers to cause a denial of service (out-of-bounds array access) or
possibly have unspecified other impact via crafted CCITT FAX data.

The init_tile function in libavcodec/jpeg2000dec.c in FFmpeg before
2.8.2 does not enforce minimum-value and maximum-value constraints on
tile coordinates, which allows remote attackers to cause a denial of
service (out-of-bounds array access) or possibly have unspecified
other impact via crafted JPEG 2000 data.

The jpeg2000_read_main_headers function in libavcodec/jpeg2000dec.c in
FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does
not enforce uniqueness of the SIZ marker in a JPEG 2000 image, which
allows remote attackers to cause a denial of service (out-of-bounds
heap-memory access) or possibly have unspecified other impact via a
crafted image with two or more of these markers.

Integer overflow in the ff_ivi_init_planes function in
libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x
through 2.8.2 allows remote attackers to cause a denial of service
(out-of-bounds heap-memory access) or possibly have unspecified other
impact via crafted image dimensions in Indeo Video Interactive data.

The smka_decode_frame function in libavcodec/smacker.c in FFmpeg
before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not
verify that the data size is consistent with the number of channels,
which allows remote attackers to cause a denial of service
(out-of-bounds array access) or possibly have unspecified other impact
via crafted Smacker data.

See also :

http://www.nessus.org/u?df1a1bd8
http://www.nessus.org/u?863da8c9
http://www.nessus.org/u?f905b5c0
http://www.nessus.org/u?abf9f942
http://www.nessus.org/u?38aeb8a2
http://www.nessus.org/u?83fa2994
http://www.nessus.org/u?a9020836
http://www.nessus.org/u?a67cce36
https://ffmpeg.org/security.html
http://www.nessus.org/u?79880509

Solution :

Update the affected packages.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)

Family: FreeBSD Local Security Checks

Nessus Plugin ID: 87178 ()

Bugtraq ID:

CVE ID: CVE-2015-6761
CVE-2015-8216
CVE-2015-8217
CVE-2015-8218
CVE-2015-8219
CVE-2015-8363
CVE-2015-8364
CVE-2015-8365

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now