ALT-BU-2018-3553-1
Branch sisyphus update bulletin.
Closed vulnerabilities
BDU:2020-00758
Уязвимость функции flv_write_packet мультимедийной библиотеки FFmpeg, связанная с отсутствием проверки на наличие пустого аудиопакета, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2018-15822
The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure.
- https://github.com/FFmpeg/FFmpeg/commit/6b67d7f05918f7a1ee8fc6ff21355d7e8736aa10
- https://github.com/FFmpeg/FFmpeg/commit/6b67d7f05918f7a1ee8fc6ff21355d7e8736aa10
- https://github.com/FFmpeg/FFmpeg/commit/d8ecb335fe4852bbc172c7b79e66944d158b4d92
- https://github.com/FFmpeg/FFmpeg/commit/d8ecb335fe4852bbc172c7b79e66944d158b4d92
- [debian-lts-announce] 20190529 [SECURITY] [DLA 1809-1] libav security update
- [debian-lts-announce] 20190529 [SECURITY] [DLA 1809-1] libav security update
- 20190523 [SECURITY] [DSA 4449-1] ffmpeg security update
- 20190523 [SECURITY] [DSA 4449-1] ffmpeg security update
- USN-3967-1
- USN-3967-1
- USN-4431-1
- USN-4431-1
- DSA-4449
- DSA-4449
Closed vulnerabilities
Modified: 2024-11-21
CVE-2015-8863
Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.
- openSUSE-SU-2016:1212
- openSUSE-SU-2016:1212
- openSUSE-SU-2016:1214
- openSUSE-SU-2016:1214
- RHSA-2016:1098
- RHSA-2016:1098
- RHSA-2016:1099
- RHSA-2016:1099
- RHSA-2016:1106
- RHSA-2016:1106
- [oss-security] 20160423 CVE Request: jq: heap buffer overflow in tokenadd() function
- [oss-security] 20160423 CVE Request: jq: heap buffer overflow in tokenadd() function
- [oss-security] 20160423 Re: CVE Request: jq: heap buffer overflow in tokenadd() function
- [oss-security] 20160423 Re: CVE Request: jq: heap buffer overflow in tokenadd() function
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802231
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802231
- https://github.com/stedolan/jq/commit/8eb1367ca44e772963e704a700ef72ae2e12babd
- https://github.com/stedolan/jq/commit/8eb1367ca44e772963e704a700ef72ae2e12babd
- https://github.com/stedolan/jq/issues/995
- https://github.com/stedolan/jq/issues/995
- GLSA-201612-20
- GLSA-201612-20
Modified: 2024-11-21
CVE-2016-4074
The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixed in jq 1.6_rc1-r0.
- [oss-security] 20160424 CVE Request: jq: stack exhaustion using jv_dump_term() function
- [oss-security] 20160424 CVE Request: jq: stack exhaustion using jv_dump_term() function
- [oss-security] 20160424 Re: CVE Request: jq: stack exhaustion using jv_dump_term() function
- [oss-security] 20160424 Re: CVE Request: jq: stack exhaustion using jv_dump_term() function
- https://github.com/hashicorp/consul/issues/10263
- https://github.com/hashicorp/consul/issues/10263
- https://github.com/NixOS/nixpkgs/pull/18908
- https://github.com/NixOS/nixpkgs/pull/18908
- https://github.com/stedolan/jq/
- https://github.com/stedolan/jq/
- https://github.com/stedolan/jq/issues/1136
- https://github.com/stedolan/jq/issues/1136