ALT-BU-2020-3677-1
Branch sisyphus update bulletin.
Closed vulnerabilities
BDU:2021-03353
Уязвимость функции read_metadata_vorbiscomment_() компонента src/libFLAC/stream_decoder.c аудиокодека FLAC, связанная с отсутствием освобождения ресурса после истечения действительного срока его эксплуатирования, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2017-6888
An error in the "read_metadata_vorbiscomment_()" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a specially crafted FLAC file.
- https://git.xiph.org/?p=flac.git%3Ba=commit%3Bh=4f47b63e9c971e6391590caf00a0f2a5ed612e67
- https://git.xiph.org/?p=flac.git%3Ba=commit%3Bh=4f47b63e9c971e6391590caf00a0f2a5ed612e67
- [debian-lts-announce] 20210104 [SECURITY] [DLA 2514-1] flac security update
- [debian-lts-announce] 20210104 [SECURITY] [DLA 2514-1] flac security update
- FEDORA-2021-ed9c13a1d5
- FEDORA-2021-ed9c13a1d5
- FEDORA-2021-a48ccc6754
- FEDORA-2021-a48ccc6754
- https://secuniaresearch.flexerasoftware.com/advisories/82639/
- https://secuniaresearch.flexerasoftware.com/advisories/82639/
- https://secuniaresearch.flexerasoftware.com/secunia_research/2017-7/
- https://secuniaresearch.flexerasoftware.com/secunia_research/2017-7/
Closed vulnerabilities
BDU:2022-01699
Уязвимость функции put_weighted_bipred_16_fallback реализации видеокодека h.265 Libde265, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-01736
Уязвимость функции mc_luma реализации видеокодека h.265 Libde265, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-01745
Уязвимость функции mc_chroma реализации видеокодека h.265 Libde265, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-01746
Уязвимость функции ff_hevc_put_unweighted_pred_8_sse реализации видеокодека h.265 Libde265, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2022-01747
Уязвимость функции put_weighted_pred_avg_16_fallback реализации видеокодека h.265 Libde265, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-01748
Уязвимость функции put_qpel_0_0_fallback_16 реализации видеокодека h.265 Libde265, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-01749
Уязвимость функции apply_sao_internal реализации видеокодека h.265 Libde265, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-02081
Уязвимость функции put_epel_hv_fallback реализации видеокодека h.265 Libde265, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-02082
Уязвимость функции decode_CABAC_bit реализации видеокодека h.265 Libde265, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-02084
Уязвимость функции de265_image::available_zscan реализации видеокодека h.265 Libde265, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-02085
Уязвимость функции put_qpel_fallback реализации видеокодека h.265 Libde265, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-02086
Уязвимость функции _mm_loadl_epi64 реализации видеокодека h.265 Libde265, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-02087
Уязвимость функции put_epel_16_fallback реализации видеокодека h.265 Libde265, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2020-21594
libde265 v1.0.4 contains a heap buffer overflow in the put_epel_hv_fallback function, which can be exploited via a crafted a file.
Modified: 2024-11-21
CVE-2020-21595
libde265 v1.0.4 contains a heap buffer overflow in the mc_luma function, which can be exploited via a crafted a file.
Modified: 2024-11-21
CVE-2020-21596
libde265 v1.0.4 contains a global buffer overflow in the decode_CABAC_bit function, which can be exploited via a crafted a file.
Modified: 2024-11-21
CVE-2020-21597
libde265 v1.0.4 contains a heap buffer overflow in the mc_chroma function, which can be exploited via a crafted a file.
Modified: 2024-11-21
CVE-2020-21598
libde265 v1.0.4 contains a heap buffer overflow in the ff_hevc_put_unweighted_pred_8_sse function, which can be exploited via a crafted a file.
- https://cwe.mitre.org/data/definitions/122.html
- https://cwe.mitre.org/data/definitions/122.html
- https://github.com/strukturag/libde265/issues/237
- https://github.com/strukturag/libde265/issues/237
- [debian-lts-announce] 20230124 [SECURITY] [DLA 3280-1] libde265 security update
- [debian-lts-announce] 20230124 [SECURITY] [DLA 3280-1] libde265 security update
- DSA-5346
- DSA-5346
Modified: 2024-11-21
CVE-2020-21599
libde265 v1.0.4 contains a heap buffer overflow in the de265_image::available_zscan function, which can be exploited via a crafted a file.
Modified: 2024-11-21
CVE-2020-21600
libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_pred_avg_16_fallback function, which can be exploited via a crafted a file.
Modified: 2024-11-21
CVE-2020-21601
libde265 v1.0.4 contains a stack buffer overflow in the put_qpel_fallback function, which can be exploited via a crafted a file.
Modified: 2024-11-21
CVE-2020-21602
libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_bipred_16_fallback function, which can be exploited via a crafted a file.
Modified: 2024-11-21
CVE-2020-21603
libde265 v1.0.4 contains a heap buffer overflow in the put_qpel_0_0_fallback_16 function, which can be exploited via a crafted a file.
Modified: 2024-11-21
CVE-2020-21604
libde265 v1.0.4 contains a heap buffer overflow fault in the _mm_loadl_epi64 function, which can be exploited via a crafted a file.
Modified: 2024-11-21
CVE-2020-21605
libde265 v1.0.4 contains a segmentation fault in the apply_sao_internal function, which can be exploited via a crafted a file.
Modified: 2024-11-21
CVE-2020-21606
libde265 v1.0.4 contains a heap buffer overflow fault in the put_epel_16_fallback function, which can be exploited via a crafted a file.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2020-14039
In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.
- openSUSE-SU-2020:1087
- openSUSE-SU-2020:1087
- openSUSE-SU-2020:1095
- openSUSE-SU-2020:1095
- openSUSE-SU-2020:1405
- openSUSE-SU-2020:1405
- openSUSE-SU-2020:1407
- openSUSE-SU-2020:1407
- https://groups.google.com/forum/#%21forum/golang-announce
- https://groups.google.com/forum/#%21forum/golang-announce
- https://groups.google.com/forum/#%21topic/golang-announce/XZNfaiwgt2w
- https://groups.google.com/forum/#%21topic/golang-announce/XZNfaiwgt2w
- https://security.netapp.com/advisory/ntap-20200731-0005/
- https://security.netapp.com/advisory/ntap-20200731-0005/
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
Modified: 2024-11-21
CVE-2020-15586
Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.
- openSUSE-SU-2020:1087
- openSUSE-SU-2020:1087
- openSUSE-SU-2020:1095
- openSUSE-SU-2020:1095
- openSUSE-SU-2020:1405
- openSUSE-SU-2020:1405
- openSUSE-SU-2020:1407
- openSUSE-SU-2020:1407
- https://groups.google.com/forum/#%21topic/golang-announce/f2c5bqrGH_g
- https://groups.google.com/forum/#%21topic/golang-announce/f2c5bqrGH_g
- https://groups.google.com/forum/#%21topic/golang-announce/XZNfaiwgt2w
- https://groups.google.com/forum/#%21topic/golang-announce/XZNfaiwgt2w
- [debian-lts-announce] 20201121 [SECURITY] [DLA 2459-1] golang-1.7 security update
- [debian-lts-announce] 20201121 [SECURITY] [DLA 2459-1] golang-1.7 security update
- [debian-lts-announce] 20201121 [SECURITY] [DLA 2460-1] golang-1.8 security update
- [debian-lts-announce] 20201121 [SECURITY] [DLA 2460-1] golang-1.8 security update
- FEDORA-2020-d75360e2b0
- FEDORA-2020-d75360e2b0
- FEDORA-2020-9cd1204ba0
- FEDORA-2020-9cd1204ba0
- https://security.netapp.com/advisory/ntap-20200731-0005/
- https://security.netapp.com/advisory/ntap-20200731-0005/
- https://www.cloudfoundry.org/blog/cve-2020-15586/
- https://www.cloudfoundry.org/blog/cve-2020-15586/
- DSA-4848
- DSA-4848
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html