[SECURITY] [DLA 2818-1] ffmpeg security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2818-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Anton Gladky
November 13, 2021 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : ffmpeg
Version : 7:3.2.16-1+deb9u1
CVE ID : CVE-2020-20445 CVE-2020-20446 CVE-2020-20451 CVE-2020-20453
CVE-2020-22037 CVE-2020-22041 CVE-2020-22044 CVE-2020-22046
CVE-2020-22048 CVE-2020-22049 CVE-2020-22054 CVE-2021-38171
CVE-2021-38291
Multiple issues have been discovered in ffmpeg - tools for transcoding,
streaming and playing of multimedia files.
CVE-2020-20445
Divide By Zero issue via libavcodec/lpc.h, which allows a remote malicious
user to cause a Denial of Service.
CVE-2020-20446
Divide By Zero issue via libavcodec/aacpsy.c, which allows a remote malicious
user to cause a Denial of Service.
CVE-2020-20451
Denial of Service issue due to resource management errors via
fftools/cmdutils.c.
CVE-2020-20453
Divide By Zero issue via libavcodec/aaccoder, which allows a remote
malicious user to cause a Denial of Service.
CVE-2020-22037
A Denial of Service vulnerability due to a memory leak in
avcodec_alloc_context3 at options.c
CVE-2020-22041
A Denial of Service vulnerability due to a memory leak in
the av_buffersrc_add_frame_flags function in buffersrc.
CVE-2020-22044
A Denial of Service vulnerability due to a memory leak in the
url_open_dyn_buf_internal function in libavformat/aviobuf.c.
CVE-2020-22046
A Denial of Service vulnerability due to a memory leak in the
avpriv_float_dsp_allocl function in libavutil/float_dsp.c.
CVE-2020-22048
A Denial of Service vulnerability due to a memory leak in the
ff_frame_pool_get function in framepool.c.
CVE-2020-22049
A Denial of Service vulnerability due to a memory leak in the
wtvfile_open_sector function in wtvdec.c.
CVE-2020-22054
A Denial of Service vulnerability due to a memory leak in the av_dict_set
function in dict.c.
CVE-2021-38171
adts_decode_extradata in libavformat/adtsenc.c does not check the
init_get_bits return value, which is a necessary step because the second
argument to init_get_bits can be crafted.
CVE-2021-38291
Assertion failure at src/libavutil/mathematics.c, causing ffmpeg aborted
is detected. In some extrme cases, like with adpcm_ms samples with an
extremely high channel count, get_audio_frame_duration() may return a
negative frame duration value.
For Debian 9 stretch, these problems have been fixed in version
7:3.2.16-1+deb9u1.
We recommend that you upgrade your ffmpeg packages.
For the detailed security status of ffmpeg please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ffmpeg
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEu71F6oGKuG/2fnKF0+Fzg8+n/wYFAmGRdfMACgkQ0+Fzg8+n
/wYM1hAAlHzYwm9B2nvTdl09cQjxypZel3vsSLywadLMkwxz+nOkqT8eKK7NUCx+
DDuCEpNKx8NXudadNxp3RFgjkmC72cB9aFZsjaq2OoycCJhRK43hTWNt+4fEuSWZ
AVThV5bC72usSf2bW56cHsiF1nIJqkPIlc9wpPBXPz+sVSoDrZAN7npzdMmrZbEi
jakCPqUAtOfJXMlphT5rN91DVFvHbSeeSl4YSVk4/ne7vPv8exy2eQH1UfHOu7JY
7jzg15Y9H5eQILlVTyj5Kjqf8oC20toyMTFJLYTnBBlnRGjDa71RqBajWN3wfH2h
HNrLrFuqpeR0L5Pp7BdybGETHTh4xdXthj6yWQr83rGJt6qSr4wbB7cYyhp/fPci
+5k92Cr/4+GVtbZ5Mf3swqVuak6N+FHHhO3RmcNGxaGBf8FGo6R4appfbMITusow
AdJWeGIwIU57jPkD3gVAuySWJGtm2jiqpHMpL7tF9t4ZX/tOE3Anzoxtql+qJhZH
fU+GdJ6giWA80NnpicG44I6dh/yC8zL3B/nXRI/dBVVgmSEwL4ypFfj/C491nx2i
FQ/suwiZLaSip8dDyjsb6kdvvoivRqMZhzmWlsp3cdvJluJdqSfMMG0sI9J7nxfk
phWZs4mBriPSOu+zQoLr7uyqtL/sSHeQ0gINBAN9iO5sagG6aBk=
=2qUQ
-----END PGP SIGNATURE-----
Reply to: