Heap Buffer Overflow Vulnerability in libde265 v1.0.14
Summary
CVE-2023-49465: Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_prediction function at motion.cc. Affects libde265 across 2 version ranges.
< 1.0.15-r0
< 7065a5304bff5b024fbbb55f2d5cee1c4ad988fd
Fixed in 1.0.15-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libde265 is an open-source library for decoding and encoding High Efficiency Video Coding (HEVC) video streams. It provides functionality for efficient video compression and decompression. The library is widely used in various applications and platforms. However, a vulnerability has been discovered in version 1.0.14 of libde265, which could lead to a heap buffer overflow.
Vulnerability Detail
The vulnerability exists in the derive_spatial_luma_vector_prediction function in the motion.cc file of libde265 v1.0.14. This function is responsible for deriving spatial luma vector predictions. Due to improper input validation, an attacker can exploit this vulnerability by providing specially crafted input, leading to a heap buffer overflow. This could potentially result in arbitrary code execution, denial of service, or information disclosure.
How To Fix
Minimum fixed version
1.0.15-r0
This is the first release that contains the fix.
sudo apk add --upgrade libde265Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of libde265 to mitigate the risk.
Conclusion
The heap buffer overflow vulnerability in libde265 v1.0.14 can have severe consequences, including arbitrary code execution, denial of service, or information disclosure. It is crucial to update to version 1.0.15-r0 or later to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libde265 →
FAQ
libde265 is an open-source library for decoding and encoding HEVC video streams.
The vulnerability could allow an attacker to execute arbitrary code, cause a denial of service, or disclose sensitive information.
Versions 1.0.14 of libde265 in Alpine Linux distributions v3.16, v3.17, v3.18, and v3.19 are affected.
Yes, upgrading to version 1.0.15-r0 or later of libde265 fixes the vulnerability.
No, updating to the fixed version is the only known solution.
Related vulnerabilities
Recent vulnerabilities recorded for libde265.
