Debian Security Advisory
DLA-464-1 libav -- LTS security update
- Date Reported:
- 10 May 2016
- Affected Packages:
- Security database references:
- In Mitre's CVE dictionary: CVE-2014-9676.
- More information:
It was discovered that there was a use-after free vulnerability in libav, a multimedia player, server, encoder and transcoder library.
The seg_write_packet function in libavformat/segment.c in ffmpeg 2.1.4 and earlier does not free the correct memory location, which allows remote attackers to cause a denial of service ("invalid memory handler") and possibly execute arbitrary code via a crafted video that triggers a use after free.
For Debian 7 Wheezy, this issue has been fixed in libav version 6:0.8.17-2+deb7u1.
We recommend that you upgrade your libav packages.