Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2016:1652-1

Опубликовано: 22 июн. 2016
Источник: suse-cvrf

Описание

Security update for vlc

This update for vlc to 2.2.4 to fix the following security issue:

  • CVE-2016-5108: Fix out-of-bound write in adpcm QT IMA codec (boo#984382).

This also include an update of codecs and libraries to fix these 3rd party security issues:

  • CVE-2016-1514: Matroska libebml EbmlUnicodeString Heap Information Leak
  • CVE-2016-1515: Matroska libebml Multiple ElementList Double Free Vulnerabilities
  • CVE-2015-7981: The png_convert_to_rfc1123 function in png.c in libpng allowed remote attackers to obtain sensitive process memory information via crafted tIME chunk data in an image file, which triggers an out-of-bounds read (bsc#952051).
  • CVE-2015-8126: Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image (bsc#954980).

Список пакетов

openSUSE Leap 42.1
libvlc5-2.2.4-27.1
libvlccore8-2.2.4-27.1
vlc-2.2.4-27.1
vlc-devel-2.2.4-27.1
vlc-noX-2.2.4-27.1
vlc-noX-lang-2.2.4-27.1
vlc-qt-2.2.4-27.1

Ссылки

Описание

The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory information via crafted tIME chunk data in an image file, which triggers an out-of-bounds read.

Затронутые продукты
openSUSE Leap 42.1:libvlc5-2.2.4-27.1
openSUSE Leap 42.1:libvlccore8-2.2.4-27.1
openSUSE Leap 42.1:vlc-2.2.4-27.1
openSUSE Leap 42.1:vlc-devel-2.2.4-27.1
Ссылки

Описание

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.

Затронутые продукты
openSUSE Leap 42.1:libvlc5-2.2.4-27.1
openSUSE Leap 42.1:libvlccore8-2.2.4-27.1
openSUSE Leap 42.1:vlc-2.2.4-27.1
openSUSE Leap 42.1:vlc-devel-2.2.4-27.1
Ссылки

Описание

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-8790. Reason: This candidate is a reservation duplicate of CVE-2015-8790. Notes: All CVE users should reference CVE-2015-8790 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

Затронутые продукты
openSUSE Leap 42.1:libvlc5-2.2.4-27.1
openSUSE Leap 42.1:libvlccore8-2.2.4-27.1
openSUSE Leap 42.1:vlc-2.2.4-27.1
openSUSE Leap 42.1:vlc-devel-2.2.4-27.1
Ссылки

Описание

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-8789. Reason: This candidate is a reservation duplicate of CVE-2015-8789. Notes: All CVE users should reference CVE-2015-8789 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

Затронутые продукты
openSUSE Leap 42.1:libvlc5-2.2.4-27.1
openSUSE Leap 42.1:libvlccore8-2.2.4-27.1
openSUSE Leap 42.1:vlc-2.2.4-27.1
openSUSE Leap 42.1:vlc-devel-2.2.4-27.1
Ссылки

Описание

Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.

Затронутые продукты
openSUSE Leap 42.1:libvlc5-2.2.4-27.1
openSUSE Leap 42.1:libvlccore8-2.2.4-27.1
openSUSE Leap 42.1:vlc-2.2.4-27.1
openSUSE Leap 42.1:vlc-devel-2.2.4-27.1
Ссылки