The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5346 advisory.

  - libde265 v1.0.4 contains a heap buffer overflow in the put_epel_hv_fallback function, which can be     exploited via a crafted a file. (CVE-2020-21594)

  - libde265 v1.0.4 contains a heap buffer overflow in the mc_luma function, which can be exploited via a     crafted a file. (CVE-2020-21595)

  - libde265 v1.0.4 contains a global buffer overflow in the decode_CABAC_bit function, which can be exploited     via a crafted a file. (CVE-2020-21596)

  - libde265 v1.0.4 contains a heap buffer overflow in the mc_chroma function, which can be exploited via a     crafted a file. (CVE-2020-21597)

  - libde265 v1.0.4 contains a heap buffer overflow in the ff_hevc_put_unweighted_pred_8_sse function, which     can be exploited via a crafted a file. (CVE-2020-21598)

  - libde265 v1.0.4 contains a heap buffer overflow in the de265_image::available_zscan function, which can be     exploited via a crafted a file. (CVE-2020-21599)

  - libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_pred_avg_16_fallback function, which     can be exploited via a crafted a file. (CVE-2020-21600)

  - libde265 v1.0.4 contains a stack buffer overflow in the put_qpel_fallback function, which can be exploited     via a crafted a file. (CVE-2020-21601)

  - libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_bipred_16_fallback function, which can     be exploited via a crafted a file. (CVE-2020-21602)

  - libde265 v1.0.4 contains a heap buffer overflow in the put_qpel_0_0_fallback_16 function, which can be     exploited via a crafted a file. (CVE-2020-21603)

  - libde265 v1.0.4 contains a heap buffer overflow fault in the _mm_loadl_epi64 function, which can be     exploited via a crafted a file. (CVE-2020-21604)

  - libde265 v1.0.4 contains a segmentation fault in the apply_sao_internal function, which can be exploited     via a crafted a file. (CVE-2020-21605)

  - libde265 v1.0.4 contains a heap buffer overflow fault in the put_epel_16_fallback function, which can be     exploited via a crafted a file. (CVE-2020-21606)

  - An Incorrect Access Control vulnerability exists in libde265 v1.0.8 due to a SEGV in slice.cc.
    (CVE-2021-35452)

  - An issue was discovered in libde265 v1.0.8.There is a Heap-use-after-free in intrapred.h when decoding     file using dec265. (CVE-2021-36408)

  - There is an Assertion `scaling_list_pred_matrix_id_delta==1' failed at sps.cc:925 in libde265 v1.0.8 when     decoding file, which allows attackers to cause a Denial of Service (DoS) by running the application with a     crafted file or possibly have unspecified other impact. (CVE-2021-36409)

  - A stack-buffer-overflow exists in libde265 v1.0.8 via fallback-motion.cc in function put_epel_hv_fallback     when running program dec265. (CVE-2021-36410)

  - An issue has been found in libde265 v1.0.8 due to incorrect access control. A SEGV caused by a READ memory     access in function derive_boundaryStrength of deblock.cc has occurred. The vulnerability causes a     segmentation fault and application crash, which leads to remote denial of service. (CVE-2021-36411)

  - Heap-based Buffer Overflow in GitHub repository strukturag/libde265 prior to and including 1.0.8. The fix     is established in commit 8e89fe0e175d2870c39486fdd09250b230ec10b8 but does not yet belong to an official     release. (CVE-2022-1253)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     ff_hevc_put_hevc_epel_pixels_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial     of Service (DoS) via a crafted video file. (CVE-2022-43235)

  - Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via     put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43236)

  - Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via void     put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43237)

  - Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_h_3_v_3_sse in sse-     motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video     file. (CVE-2022-43238)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_chroma<unsigned     short> in motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted     video file. (CVE-2022-43239)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     ff_hevc_put_hevc_qpel_h_2_v_1_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial     of Service (DoS) via a crafted video file. (CVE-2022-43240)

  - Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_v_3_8_sse in sse-     motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video     file. (CVE-2022-43241)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_luma<unsigned char>     in motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video     file. (CVE-2022-43242)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     ff_hevc_put_weighted_pred_avg_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43243)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43244)

  - Libde265 v1.0.8 was discovered to contain a segmentation violation via apply_sao_internal<unsigned short>     in sao.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video     file. (CVE-2022-43245)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     put_weighted_pred_avg_16_fallback in fallback-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43248)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43249)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     put_qpel_0_0_fallback_16 in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of     Service (DoS) via a crafted video file. (CVE-2022-43250)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_16_fallback in     fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted     video file. (CVE-2022-43252)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     put_unweighted_pred_16_fallback in fallback-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43253)

  - Libde265 1.0.9 is vulnerable to Buffer Overflow in function void put_qpel_fallback<unsigned short>     (CVE-2022-47655)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3240 advisory.

  - libde265 v1.0.4 contains a heap buffer overflow in the de265_image::available_zscan function, which can be     exploited via a crafted a file. (CVE-2020-21599)

  - An Incorrect Access Control vulnerability exists in libde265 v1.0.8 due to a SEGV in slice.cc.
    (CVE-2021-35452)

  - An issue was discovered in libde265 v1.0.8.There is a Heap-use-after-free in intrapred.h when decoding     file using dec265. (CVE-2021-36408)

  - There is an Assertion `scaling_list_pred_matrix_id_delta==1' failed at sps.cc:925 in libde265 v1.0.8 when     decoding file, which allows attackers to cause a Denial of Service (DoS) by running the application with a     crafted file or possibly have unspecified other impact. (CVE-2021-36409)

  - A stack-buffer-overflow exists in libde265 v1.0.8 via fallback-motion.cc in function put_epel_hv_fallback     when running program dec265. (CVE-2021-36410)

  - An issue has been found in libde265 v1.0.8 due to incorrect access control. A SEGV caused by a READ memory     access in function derive_boundaryStrength of deblock.cc has occurred. The vulnerability causes a     segmentation fault and application crash, which leads to remote denial of service. (CVE-2021-36411)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6627-1 advisory.

  - An Incorrect Access Control vulnerability exists in libde265 v1.0.8 due to a SEGV in slice.cc.
    (CVE-2021-35452)

  - An issue was discovered in libde265 v1.0.8.There is a Heap-use-after-free in intrapred.h when decoding     file using dec265. (CVE-2021-36408)

  - There is an Assertion `scaling_list_pred_matrix_id_delta==1' failed at sps.cc:925 in libde265 v1.0.8 when     decoding file, which allows attackers to cause a Denial of Service (DoS) by running the application with a     crafted file or possibly have unspecified other impact. (CVE-2021-36409)

  - A stack-buffer-overflow exists in libde265 v1.0.8 via fallback-motion.cc in function put_epel_hv_fallback     when running program dec265. (CVE-2021-36410)

  - An issue has been found in libde265 v1.0.8 due to incorrect access control. A SEGV caused by a READ memory     access in function derive_boundaryStrength of deblock.cc has occurred. The vulnerability causes a     segmentation fault and application crash, which leads to remote denial of service. (CVE-2021-36411)

  - Heap-based Buffer Overflow in GitHub repository strukturag/libde265 prior to and including 1.0.8. The fix     is established in commit 8e89fe0e175d2870c39486fdd09250b230ec10b8 but does not yet belong to an official     release. (CVE-2022-1253)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     ff_hevc_put_hevc_epel_pixels_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial     of Service (DoS) via a crafted video file. (CVE-2022-43235)

  - Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via     put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43236)

  - Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via void     put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43237)

  - Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_h_3_v_3_sse in sse-     motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video     file. (CVE-2022-43238)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_chroma<unsigned     short> in motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted     video file. (CVE-2022-43239)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     ff_hevc_put_hevc_qpel_h_2_v_1_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial     of Service (DoS) via a crafted video file. (CVE-2022-43240)

  - Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_v_3_8_sse in sse-     motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video     file. (CVE-2022-43241)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_luma<unsigned char>     in motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video     file. (CVE-2022-43242)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     ff_hevc_put_weighted_pred_avg_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43243)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     put_weighted_pred_avg_16_fallback in fallback-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43248)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_16_fallback in     fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted     video file. (CVE-2022-43252)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     put_unweighted_pred_16_fallback in fallback-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43253)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
171376	Debian DSA-5346-1 : libde265 - security update	Nessus	Debian Local Security Checks	2/11/2023	9/4/2023	critical
168855	Debian DLA-3240-1 : libde265 - LTS security update	Nessus	Debian Local Security Checks	12/16/2022	9/15/2023	high
190241	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS : libde265 vulnerabilities (USN-6627-1)	Nessus	Ubuntu Local Security Checks	2/8/2024	2/8/2024	critical

Detections

Analytics

Plugins Search

critical

high

critical