Security Update for libav
Summary
DLA-644-1: libav - security update. Affects libav versions < 6:0.8.18-0+deb7u1. Fixed in 6:0.8.18-0+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libav is a multimedia framework that provides a set of tools for encoding, decoding, and streaming audio and video. It is widely used in various applications and platforms. However, multiple vulnerabilities have been discovered in libav, which could potentially be exploited by attackers to cause a denial of service or execute arbitrary code.
Vulnerability Detail
One of the vulnerabilities, identified as CVE-2015-1872, exists in the ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c. This function fails to validate the number of components in a JPEG-LS Start Of Frame segment, allowing remote attackers to trigger an out-of-bounds array access, resulting in a denial of service or other unspecified impact.
Another vulnerability, CVE-2015-5479, affects the ff_h263_decode_mba function in libavcodec/ituh263dec.c. Attackers can exploit this flaw by providing a file with crafted dimensions, leading to a divide-by-zero error and causing the application to crash.
The third vulnerability, CVE-2016-7393, is found in the aac_sync function in libavcodec/aac_parser.c. This function is susceptible to a stack-based buffer overflow, which can be exploited by an attacker to execute arbitrary code or cause a denial of service.
How To Fix
Minimum fixed version
6:0.8.18-0+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libavTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Multiple vulnerabilities have been identified in libav, including out-of-bounds array access, divide-by-zero error, and stack-based buffer overflow. Upgrading to version 6:0.8.18-0+deb7u1 or later is crucial to mitigate these security risks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libav →
FAQ
libav is a multimedia framework that provides tools for audio and video encoding, decoding, and streaming.
CVE-2015-1872 can allow remote attackers to cause a denial of service or potentially have other unspecified impacts by exploiting a flaw in the ff_mjpeg_decode_sof function.
CVE-2015-5479 can be exploited by providing a file with crafted dimensions, triggering a divide-by-zero error and causing the application to crash.
CVE-2016-7393 poses a risk of arbitrary code execution or denial of service due to a stack-based buffer overflow in the aac_sync function.
To fix these vulnerabilities, it is recommended to upgrade the libav packages to version 6:0.8.18-0+deb7u1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for libav.
