Debian Security Advisory

DLA-464-1 libav -- LTS security update

Date Reported:
10 May 2016
Affected Packages:
Security database references:
In Mitre's CVE dictionary: CVE-2014-9676.
More information:

It was discovered that there was a use-after free vulnerability in libav, a multimedia player, server, encoder and transcoder library.

The seg_write_packet function in libavformat/segment.c in ffmpeg 2.1.4 and earlier does not free the correct memory location, which allows remote attackers to cause a denial of service ("invalid memory handler") and possibly execute arbitrary code via a crafted video that triggers a use after free.

For Debian 7 Wheezy, this issue has been fixed in libav version 6:0.8.17-2+deb7u1.

We recommend that you upgrade your libav packages.