Lucene search

DebianDEBIAN:DLA-2537-1:1C8E4

HistoryJan 31, 2021 - 5:06 a.m.

[SECURITY] [DLA 2537-1] ffmpeg security update

2021-01-3105:06:50

lists.debian.org

ffmpeg

security update

multimedia framework

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.02

Percentile

89.0%

JSON

Debian LTS Advisory DLA-2537-1 [email protected]
https://www.debian.org/lts/security/ Roberto C. Sánchez
January 31, 2021 https://wiki.debian.org/LTS

Package : ffmpeg
Version : 7:3.2.15-0+deb9u2
CVE ID : CVE-2019-17539 CVE-2020-35965
Debian Bug : 979999

Two vulnerabilities have been discovered in ffmpeg, a widely used
multimedia framework.

CVE-2019-17539

a NULL pointer dereference and possibly unspecified other impact
when there is no valid close function pointer

CVE-2020-35965

an out-of-bounds write because of errors in calculations of when to
perform memset zero operations

For Debian 9 stretch, these problems have been fixed in version
7:3.2.15-0+deb9u2.

We recommend that you upgrade your ffmpeg packages.

For the detailed security status of ffmpeg please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ffmpeg

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian9armellibavcodec-dev< 7:3.2.15-0+deb9u2libavcodec-dev_7:3.2.15-0+deb9u2_armel.deb
Debian10s390xlibswscale-dev< 7:4.1.8-0+deb10u1libswscale-dev_7:4.1.8-0+deb10u1_s390x.deb
Debian9armellibavresample-dev< 7:3.2.15-0+deb9u2libavresample-dev_7:3.2.15-0+deb9u2_armel.deb
Debian10armhflibavfilter-dev< 7:4.1.8-0+deb10u1libavfilter-dev_7:4.1.8-0+deb10u1_armhf.deb
Debian10amd64libavfilter-extra7< 7:4.1.8-0+deb10u1libavfilter-extra7_7:4.1.8-0+deb10u1_amd64.deb
Debian10mipsellibavresample-dev< 7:4.1.8-0+deb10u1libavresample-dev_7:4.1.8-0+deb10u1_mipsel.deb
Debian10mips64ellibswscale5< 7:4.1.8-0+deb10u1libswscale5_7:4.1.8-0+deb10u1_mips64el.deb
Debian9arm64libavresample3< 7:3.2.15-0+deb9u2libavresample3_7:3.2.15-0+deb9u2_arm64.deb
Debian10alllibavfilter-extra< 7:4.1.8-0+deb10u1libavfilter-extra_7:4.1.8-0+deb10u1_all.deb
Debian10amd64libavformat58-dbgsym< 7:4.1.8-0+deb10u1libavformat58-dbgsym_7:4.1.8-0+deb10u1_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	armel	libavcodec-dev	< 7:3.2.15-0+deb9u2	libavcodec-dev_7:3.2.15-0+deb9u2_armel.deb
Debian	10	s390x	libswscale-dev	< 7:4.1.8-0+deb10u1	libswscale-dev_7:4.1.8-0+deb10u1_s390x.deb
Debian	9	armel	libavresample-dev	< 7:3.2.15-0+deb9u2	libavresample-dev_7:3.2.15-0+deb9u2_armel.deb
Debian	10	armhf	libavfilter-dev	< 7:4.1.8-0+deb10u1	libavfilter-dev_7:4.1.8-0+deb10u1_armhf.deb
Debian	10	amd64	libavfilter-extra7	< 7:4.1.8-0+deb10u1	libavfilter-extra7_7:4.1.8-0+deb10u1_amd64.deb
Debian	10	mipsel	libavresample-dev	< 7:4.1.8-0+deb10u1	libavresample-dev_7:4.1.8-0+deb10u1_mipsel.deb
Debian	10	mips64el	libswscale5	< 7:4.1.8-0+deb10u1	libswscale5_7:4.1.8-0+deb10u1_mips64el.deb
Debian	9	arm64	libavresample3	< 7:3.2.15-0+deb9u2	libavresample3_7:3.2.15-0+deb9u2_arm64.deb
Debian	10	all	libavfilter-extra	< 7:4.1.8-0+deb10u1	libavfilter-extra_7:4.1.8-0+deb10u1_all.deb
Debian	10	amd64	libavformat58-dbgsym	< 7:4.1.8-0+deb10u1	libavformat58-dbgsym_7:4.1.8-0+deb10u1_amd64.deb