Univention Bugzilla – Bug 53660
ffmpeg: Multiple issues (4.4)
Last modified: 2021-08-25 17:46:57 CEST
New Debian ffmpeg 7:3.2.15-0+deb9u3 fixes: This update addresses the following issues: * Buffer Overflow vulnerability exists in FFmpeg 4.1 via apng_do_inverse_blend in libavcodec/pngenc.c, which could let a remote malicious user cause a Denial of Service (CVE-2020-21041) * Buffer Overflow vulnerability in FFmpeg 4.2 in mov_write_video_tag due to the out of bounds in libavformat/movenc.c, which could let a remote malicious user obtain sensitive information, cause a Denial of Service, or execute arbitrary code. (CVE-2020-22015) * A heap-based Buffer Overflow vulnerability in FFmpeg 4.2 at libavcodec/get_bits.h when writing .mov files, which might lead to memory corruption and other potential consequences. (CVE-2020-22016) * Buffer Overflow vulnerability in FFmpeg 4.2 in the build_diff_map function in libavfilter/vf_fieldmatch.c, which could let a remote malicious user cause a Denial of Service. (CVE-2020-22020) * Buffer Overflow vulnerability in FFmpeg 4.2 at filter_edges function in libavfilter/vf_yadif.c, which could let a remote malicious user cause a Denial of Service. (CVE-2020-22021) * A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_fieldorder.c, which might lead to memory corruption and other potential consequences. (CVE-2020-22022) * A heap-based Buffer Overflow vulnerabililty exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_bitplanenoise.c, which might lead to memory corruption and other potential consequences. (CVE-2020-22023) * A heap-based Buffer Overflow vulnerability exists in gaussian_blur at libavfilter/vf_edgedetect.c, which might lead to memory corruption and other potential consequences. (CVE-2020-22025) * Buffer Overflow vulnerability exists in FFmpeg 4.2 in the config_input function at libavfilter/af_tremolo.c, which could let a remote malicious user cause a Denial of Service. (CVE-2020-22026) * Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_vertically_8 at libavfilter/vf_avgblur.c, which could cause a remote Denial of Service. (CVE-2020-22028) * A Heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_w3fdif.c in filter16_complex_low, which might lead to memory corruption and other potential consequences. (CVE-2020-22031) * A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_edgedetect.c in gaussian_blur, which might lead to memory corruption and other potential consequences. (CVE-2020-22032) * A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_intra at libavfilter/vf_bwdif.c, which might lead to memory corruption and other potential consequences. (CVE-2020-22036) * Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitimate "ffconcat" file that references an image, followed by a file the triggers the tty demuxer, the contents of the second file will be copied into the output file verbatim (as long as the `-vcodec copy` option is passed to ffmpeg). (CVE-2021-3566) * libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-2013-0868. (CVE-2021-38114)
--- mirror/ftp/4.4/unmaintained/4.4-8/source/ffmpeg_3.2.15-0+deb9u2.dsc +++ apt/ucs_4.4-0-errata4.4-8/source/ffmpeg_3.2.15-0+deb9u3.dsc @@ -1,3 +1,54 @@ +7:3.2.15-0+deb9u3 [Sat, 14 Aug 2021 18:31:23 +0200] Anton Gladky <gladk@debian.org>: + + * Non-maintainer upload by the LTS Security Team. + * CVE-2020-22036: A heap-based Buffer Overflow vulnerability + in filter_intra at libavfilter/vf_bwdif.c, which might lead + to memory corruption and other potential consequences. + * CVE-2020-22032: A heap-based Buffer Overflow vulnerability in + gaussian_blur, which might lead to memory corruption and other + potential consequences. + * CVE-2020-22031: A Heap-based Buffer Overflow vulnerability in + filter16_complex_low, which might lead to memory corruption and + other potential consequences. + * CVE-2020-22028: Buffer Overflow vulnerability in filter_vertically_8 + at libavfilter/vf_avgblur.c, which could cause a remote + Denial of Service. + * CVE-2020-22026: Buffer Overflow vulnerability exists in the config_input + function at libavfilter/af_tremolo.c, which could let a remote malicious + user cause a Denial of Service. + * CVE-2020-22025: A heap-based Buffer Overflow vulnerability exists in + gaussian_blur at libavfilter/vf_edgedetect.c, which might lead to memory + corruption and other potential consequences. + * CVE-2020-22023: A heap-based Buffer Overflow vulnerabililty exists + in filter_frame at libavfilter/vf_bitplanenoise.c, which might lead to + memory corruption and other potential consequences. + * CVE-2020-22022: A heap-based Buffer Overflow vulnerability exists in + filter_frame at libavfilter/vf_fieldorder.c, which might lead to memory + corruption and other potential consequences. + * CVE-2020-22021: Buffer Overflow vulnerability at filter_edges function in + libavfilter/vf_yadif.c, which could let a remote malicious user cause a + Denial of Service. + * CVE-2020-22020: Buffer Overflow vulnerability in the build_diff_map function + in libavfilter/vf_fieldmatch.c, which could let a remote malicious user + cause a Denial of Service. + * CVE-2020-22016: A heap-based Buffer Overflow vulnerability at + libavcodec/get_bits.h when writing .mov files, which might lead to memory + corruption and other potential consequences. + * CVE-2020-22015: Buffer Overflow vulnerability in mov_write_video_tag due to + the out of bounds in libavformat/movenc.c, which could let a remote + malicious user obtain sensitive information, cause a Denial of Service, or + execute arbitrary code. + * CVE-2020-21041: Buffer Overflow vulnerability exists via + apng_do_inverse_blend in libavcodec/pngenc.c, which could let a remote + malicious user cause a Denial of Service + * CVE-2021-3566: The tty demuxer did not have a 'read_probe' function + assigned to it. By crafting a legitimate "ffconcat" file that references an + image, followed by a file the triggers the tty demuxer, the contents of the + second file will be copied into the output file verbatim (as long as the + `-vcodec copy` option is passed to ffmpeg). + * CVE-2021-38114: libavcodec/dnxhddec.c does not check the return value of the + init_vlc function. Crafted DNxHD data can cause unspecified impact. + 7:3.2.15-0+deb9u2 [Sat, 30 Jan 2021 19:28:22 -0500] Roberto C. Sanchez <roberto@debian.org>: * Non-maintainer upload by the LTS team. <http://piuparts.knut.univention.de/4.4-8/#5124841720449009471>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.4-8] 8f046e8b41 Bug #53660: ffmpeg 7:3.2.15-0+deb9u3 doc/errata/staging/ffmpeg.yaml | 82 +++++++++++++++++++++--------------------- 1 file changed, 41 insertions(+), 41 deletions(-) [4.4-8] 30d1b68477 Bug #53660: ffmpeg 7:3.2.15-0+deb9u3 doc/errata/staging/ffmpeg.yaml | 73 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+)
<https://errata.software-univention.de/#/?erratum=4.4x1029>
New Debian ffmpeg 7:3.2.15-0+deb9u4 fixes: * Fix regression introduced in the previous upload. During the backporting of one of patches one line was wrongly interpretated and it caused the regression during the deinterlacing process. Thanks to Jari Ruusu for the reporting the issue and for the testing of prepared update.
--- mirror/ftp/4.4/unmaintained/component/4.4-8-errata/source/ffmpeg_3.2.15-0+deb9u3.dsc +++ apt/ucs_4.4-0-errata4.4-8/source/ffmpeg_3.2.15-0+deb9u4.dsc @@ -1,3 +1,12 @@ +7:3.2.15-0+deb9u4 [Sun, 22 Aug 2021 21:57:52 +0200] Anton Gladky <gladk@debian.org>: + + * Non-maintainer upload by the LTS Security Team. + * Fix regression introduced in the previous upload. + During the backporting of one of patches one line was wrongly + interpretated and it caused the regression during the + deinterlacing process. Thanks to Jari Ruusu for the reporting + the issue and for the testing of prepared update. + 7:3.2.15-0+deb9u3 [Sat, 14 Aug 2021 18:31:23 +0200] Anton Gladky <gladk@debian.org>: * Non-maintainer upload by the LTS Security Team. <http://piuparts.knut.univention.de/4.4-8/#5124841720447926946>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.4-8] 4d5eef01c1 Bug #53660: ffmpeg 7:3.2.15-0+deb9u4 doc/errata/staging/ffmpeg.yaml | 73 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+)
<https://errata.software-univention.de/#/?erratum=4.4x1030>