Описание
Security update for ffmpeg-4
This update for ffmpeg-4 to version 4.0.2 fixes the following issues:
These security issues were fixed:
- CVE-2018-15822: The flv_write_packet function did not check for an empty audio packet, leading to an assertion failure and DoS (bsc#1105869).
- CVE-2018-13300: An improper argument passed to the avpriv_request_sample function may have triggered an out-of-array read while converting a crafted AVI file to MPEG4, leading to a denial of service and possibly an information disclosure (bsc#1100348).
These non-security issues were fixed:
- Enable webvtt encoders and decoders (boo#1092241).
- Build codec2 encoder and decoder, add libcodec2 to enable_decoders and enable_encoders.
- Enable mpeg 1 and 2 encoders.
Список пакетов
SUSE Package Hub for SUSE Linux Enterprise 15
ffmpeg-4-4.0.2-bp150.3.3.1
ffmpeg-4-libavcodec-devel-4.0.2-bp150.3.3.1
ffmpeg-4-libavdevice-devel-4.0.2-bp150.3.3.1
ffmpeg-4-libavfilter-devel-4.0.2-bp150.3.3.1
ffmpeg-4-libavformat-devel-4.0.2-bp150.3.3.1
ffmpeg-4-libavresample-devel-4.0.2-bp150.3.3.1
ffmpeg-4-libavutil-devel-4.0.2-bp150.3.3.1
ffmpeg-4-libpostproc-devel-4.0.2-bp150.3.3.1
ffmpeg-4-libswresample-devel-4.0.2-bp150.3.3.1
ffmpeg-4-libswscale-devel-4.0.2-bp150.3.3.1
ffmpeg-4-private-devel-4.0.2-bp150.3.3.1
libavcodec58-4.0.2-bp150.3.3.1
libavcodec58-64bit-4.0.2-bp150.3.3.1
libavdevice58-4.0.2-bp150.3.3.1
libavdevice58-64bit-4.0.2-bp150.3.3.1
libavfilter7-4.0.2-bp150.3.3.1
libavfilter7-64bit-4.0.2-bp150.3.3.1
libavformat58-4.0.2-bp150.3.3.1
libavformat58-64bit-4.0.2-bp150.3.3.1
libavresample4-4.0.2-bp150.3.3.1
libavresample4-64bit-4.0.2-bp150.3.3.1
libavutil56-4.0.2-bp150.3.3.1
libavutil56-64bit-4.0.2-bp150.3.3.1
libpostproc55-4.0.2-bp150.3.3.1
libpostproc55-64bit-4.0.2-bp150.3.3.1
libswresample3-4.0.2-bp150.3.3.1
libswresample3-64bit-4.0.2-bp150.3.3.1
libswscale5-4.0.2-bp150.3.3.1
libswscale5-64bit-4.0.2-bp150.3.3.1
Ссылки
- E-Mail link for openSUSE-SU-2018:2723-2
- SUSE Security Ratings
Описание
In FFmpeg 4.0.1, an improper argument (AVCodecParameters) passed to the avpriv_request_sample function in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array read while converting a crafted AVI file to MPEG4, leading to a denial of service and possibly an information disclosure.
Затронутые продукты
SUSE Package Hub for SUSE Linux Enterprise 15:ffmpeg-4-4.0.2-bp150.3.3.1
SUSE Package Hub for SUSE Linux Enterprise 15:ffmpeg-4-libavcodec-devel-4.0.2-bp150.3.3.1
SUSE Package Hub for SUSE Linux Enterprise 15:ffmpeg-4-libavdevice-devel-4.0.2-bp150.3.3.1
SUSE Package Hub for SUSE Linux Enterprise 15:ffmpeg-4-libavfilter-devel-4.0.2-bp150.3.3.1
Ссылки
- CVE-2018-13300
- SUSE Bug 1100348
Описание
The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 4.0.2 does not check for an empty audio packet, leading to an assertion failure.
Затронутые продукты
SUSE Package Hub for SUSE Linux Enterprise 15:ffmpeg-4-4.0.2-bp150.3.3.1
SUSE Package Hub for SUSE Linux Enterprise 15:ffmpeg-4-libavcodec-devel-4.0.2-bp150.3.3.1
SUSE Package Hub for SUSE Linux Enterprise 15:ffmpeg-4-libavdevice-devel-4.0.2-bp150.3.3.1
SUSE Package Hub for SUSE Linux Enterprise 15:ffmpeg-4-libavfilter-devel-4.0.2-bp150.3.3.1
Ссылки
- CVE-2018-15822
- SUSE Bug 1105869