Security Update for libav
Summary
DLA-1142-1: libav - security update. Affects libav versions < 6:0.8.21-0+deb7u1. Fixed in 6:0.8.21-0+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libav is a multimedia framework that provides a set of tools for encoding, decoding, and streaming audio and video. It is widely used in various applications and platforms. However, multiple vulnerabilities have been discovered in libav, which could potentially lead to denial of service, information disclosure, or other unspecified impacts.
Vulnerability Detail
One of the vulnerabilities, identified as CVE-2015-8365, exists in the smka_decode_frame function in libavcodec/smacker.c. This function fails to validate the consistency of data size with the number of channels, allowing remote attackers to trigger an out-of-bounds array access. This could result in a denial of service or potentially have other unknown consequences.
Another vulnerability, CVE-2017-7208, affects the decode_residual function in libavcodec. Attackers can exploit this flaw to cause a buffer over-read or obtain sensitive information from the process memory by providing a specially crafted h264 video file.
Additionally, the decode_frame function in libavcodec/pictordec.c is vulnerable to an out-of-bounds write due to a heap-based buffer overflow, as indicated by CVE-2017-7862. This could potentially lead to arbitrary code execution or other malicious activities.
Lastly, CVE-2017-9992 highlights a vulnerability in the decode_dds1 function in libavcodec/dfa.c. By exploiting this flaw, remote attackers can cause a heap-based buffer overflow and application crash, resulting in a denial of service or potentially other unknown impacts.
How To Fix
Minimum fixed version
6:0.8.21-0+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libavTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, libav is susceptible to multiple vulnerabilities that could have severe consequences, including denial of service, information disclosure, and arbitrary code execution. It is crucial to update your libav packages to version 6:0.8.21-0+deb7u1 or later to mitigate these security risks. For further assistance or support in addressing these vulnerabilities, please contact DevNack.com.
See every vulnerability recorded for libav →
FAQ
libav is a multimedia framework that provides tools for encoding, decoding, and streaming audio and video. It is commonly used in various applications and platforms.
CVE-2015-8365 is a vulnerability in libav that allows remote attackers to trigger an out-of-bounds array access by exploiting the smka_decode_frame function in libavcodec/smacker.c. This can result in a denial of service or other unknown impacts.
CVE-2017-7208 can be exploited by providing a specially crafted h264 video file. Attackers can use this vulnerability to cause a buffer over-read or obtain sensitive information from the process memory.
CVE-2017-7862 allows for an out-of-bounds write due to a heap-based buffer overflow in the decode_frame function of libavcodec/pictordec.c. This vulnerability could potentially lead to arbitrary code execution or other malicious activities.
CVE-2017-9992 enables remote attackers to cause a heap-based buffer overflow and application crash by exploiting the decode_dds1 function in libavcodec/dfa.c. This can result in a denial of service or other unknown impacts.
Related vulnerabilities
Recent vulnerabilities recorded for libav.
