English | Deutsch | Español | Português
 UserID:
 Passwd:
new user
 About:   Dedicated  | Advanced  | Standard  | Recurring  | No Risk  | Desktop  | Basic  | Single  | Security Seal  | FAQ
  Price/Feature Summary  | Order  | New Vulnerabilities  | Confidentiality  | Vulnerability Search
 Vulnerability   
Search   
    Search 148472 CVE descriptions
and 72306 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.891611
Category:Debian Local Security Checks
Title:Debian LTS Advisory ([SECURITY] [DLA 1611-1 and DLA 1611-2] libav security update)
Summary:DLA 1611-1:;;Several security issues have been corrected in multiple demuxers and;decoders of the libav multimedia library.;;CVE-2014-9317;; The decode_ihdr_chunk function in libavcodec/pngdec.c allowed remote; attackers to cause a denial of service (out-of-bounds heap access); and possibly had other unspecified impact via an IDAT before an IHDR; in a PNG file. The issue got addressed by checking IHDR/IDAT order.;;CVE-2015-6761;; The update_dimensions function in libavcodec/vp8.c in libav relies on; a coefficient-partition count during multi-threaded operation, which; allowed remote attackers to cause a denial of service (race condition; and memory corruption) or possibly have unspecified other impact via; a crafted WebM file. This issue has been resolved by using; num_coeff_partitions in thread/buffer setup. The variable is not a; constant and can lead to race conditions.;;CVE-2015-6818;; The decode_ihdr_chunk function in libavcodec/pngdec.c did not enforce; uniqueness of the IHDR (aka image header) chunk in a PNG image, which; allowed remote attackers to cause a denial of service (out-of-bounds; array access) or possibly have unspecified other impact via a crafted; image with two or more of these chunks. This has now been fixed by; only allowing one IHDR chunk. Multiple IHDR chunks are forbidden in; PNG.;;Description truncated. Please see the references for more information.
Description:Summary:
DLA 1611-1:

Several security issues have been corrected in multiple demuxers and
decoders of the libav multimedia library.

CVE-2014-9317

The decode_ihdr_chunk function in libavcodec/pngdec.c allowed remote
attackers to cause a denial of service (out-of-bounds heap access)
and possibly had other unspecified impact via an IDAT before an IHDR
in a PNG file. The issue got addressed by checking IHDR/IDAT order.

CVE-2015-6761

The update_dimensions function in libavcodec/vp8.c in libav relies on
a coefficient-partition count during multi-threaded operation, which
allowed remote attackers to cause a denial of service (race condition
and memory corruption) or possibly have unspecified other impact via
a crafted WebM file. This issue has been resolved by using
num_coeff_partitions in thread/buffer setup. The variable is not a
constant and can lead to race conditions.

CVE-2015-6818

The decode_ihdr_chunk function in libavcodec/pngdec.c did not enforce
uniqueness of the IHDR (aka image header) chunk in a PNG image, which
allowed remote attackers to cause a denial of service (out-of-bounds
array access) or possibly have unspecified other impact via a crafted
image with two or more of these chunks. This has now been fixed by
only allowing one IHDR chunk. Multiple IHDR chunks are forbidden in
PNG.

Description truncated. Please see the references for more information.

Affected Software/OS:
libav on Debian Linux

Solution:
For Debian 8 'Jessie', these problems have been fixed in version
6:11.12-1~
deb8u3.

We recommend that you upgrade your libav packages.

CVSS Score:
7.5

CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2014-9317
https://security.gentoo.org/glsa/201603-06
https://lists.debian.org/debian-lts-announce/2018/12/msg00009.html
Common Vulnerability Exposure (CVE) ID: CVE-2015-6761
BugTraq ID: 77073
http://www.securityfocus.com/bid/77073
Debian Security Information: DSA-3376 (Google Search)
http://www.debian.org/security/2015/dsa-3376
https://security.gentoo.org/glsa/201603-09
RedHat Security Advisories: RHSA-2015:1912
http://rhn.redhat.com/errata/RHSA-2015-1912.html
http://www.securitytracker.com/id/1033816
http://www.ubuntu.com/usn/USN-2770-1
http://www.ubuntu.com/usn/USN-2770-2
Common Vulnerability Exposure (CVE) ID: CVE-2015-6818
http://www.securitytracker.com/id/1033483
http://www.ubuntu.com/usn/USN-2944-1
Common Vulnerability Exposure (CVE) ID: CVE-2015-6820
Common Vulnerability Exposure (CVE) ID: CVE-2015-6821
Common Vulnerability Exposure (CVE) ID: CVE-2015-6822
https://lists.debian.org/debian-lts-announce/2018/12/msg00010.html
Common Vulnerability Exposure (CVE) ID: CVE-2015-6823
Common Vulnerability Exposure (CVE) ID: CVE-2015-6824
Common Vulnerability Exposure (CVE) ID: CVE-2015-6825
Common Vulnerability Exposure (CVE) ID: CVE-2015-6826
Common Vulnerability Exposure (CVE) ID: CVE-2015-8216
SuSE Security Announcement: openSUSE-SU-2015:2120 (Google Search)
http://lists.opensuse.org/opensuse-updates/2015-11/msg00146.html
Common Vulnerability Exposure (CVE) ID: CVE-2015-8217
Common Vulnerability Exposure (CVE) ID: CVE-2015-8363
SuSE Security Announcement: openSUSE-SU-2015:2370 (Google Search)
http://lists.opensuse.org/opensuse-updates/2015-12/msg00118.html
Common Vulnerability Exposure (CVE) ID: CVE-2015-8364
Common Vulnerability Exposure (CVE) ID: CVE-2015-8661
http://www.securitytracker.com/id/1034539
SuSE Security Announcement: openSUSE-SU-2016:0089 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00004.html
Common Vulnerability Exposure (CVE) ID: CVE-2015-8662
Common Vulnerability Exposure (CVE) ID: CVE-2015-8663
CopyrightCopyright (c) 2018 Greenbone Networks GmbH http://greenbone.net

This is only one of 72306 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

New User Registration
Email:
UserID:
Passwd:
Please email me your monthly newsletters, informing the latest services, improvements & surveys.
Please email me a vulnerability test announcement whenever a new test is added.
   Privacy
Registered User Login
 
UserID:   
Passwd:  

 Forgot userid or passwd?
Email/Userid:




Home | About Us | Contact Us | Partner Programs | Developer APIs | Privacy | Mailing Lists | Abuse
Security Audits | Managed DNS | Network Monitoring | Site Analyzer | Internet Research Reports
Web Probe

© 1998-2019 E-Soft Inc. All rights reserved.