[SECURITY] [DLA 2537-1] ffmpeg security update

2021-01-3105:06:50

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.009 Low

EPSS

Percentile

82.2%

JSON

Debian LTS Advisory DLA-2537-1 [email protected]
https://www.debian.org/lts/security/ Roberto C. Sánchez
January 31, 2021 https://wiki.debian.org/LTS

Package : ffmpeg
Version : 7:3.2.15-0+deb9u2
CVE ID : CVE-2019-17539 CVE-2020-35965
Debian Bug : 979999

Two vulnerabilities have been discovered in ffmpeg, a widely used
multimedia framework.

CVE-2019-17539

a NULL pointer dereference and possibly unspecified other impact
when there is no valid close function pointer

CVE-2020-35965

an out-of-bounds write because of errors in calculations of when to
perform memset zero operations

For Debian 9 stretch, these problems have been fixed in version
7:3.2.15-0+deb9u2.

We recommend that you upgrade your ffmpeg packages.

For the detailed security status of ffmpeg please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ffmpeg

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian9armellibavresample3< 7:3.2.15-0+deb9u2libavresample3_7:3.2.15-0+deb9u2_armel.deb
Debian10allffmpeg-doc< 7:4.1.8-0+deb10u1ffmpeg-doc_7:4.1.8-0+deb10u1_all.deb
Debian10allffmpeg< 7:4.1.8-0+deb10u1ffmpeg_7:4.1.8-0+deb10u1_all.deb
Debian9armhflibswresample-dev< 7:3.2.15-0+deb9u2libswresample-dev_7:3.2.15-0+deb9u2_armhf.deb
Debian10mipsellibavcodec58-dbgsym< 7:4.1.8-0+deb10u1libavcodec58-dbgsym_7:4.1.8-0+deb10u1_mipsel.deb
Debian9armellibswscale4< 7:3.2.15-0+deb9u2libswscale4_7:3.2.15-0+deb9u2_armel.deb
Debian10arm64libpostproc-dev< 7:4.1.8-0+deb10u1libpostproc-dev_7:4.1.8-0+deb10u1_arm64.deb
Debian9arm64libpostproc54< 7:3.2.15-0+deb9u2libpostproc54_7:3.2.15-0+deb9u2_arm64.deb
Debian10mipsellibpostproc-dev< 7:4.1.8-0+deb10u1libpostproc-dev_7:4.1.8-0+deb10u1_mipsel.deb
Debian9amd64libavfilter-dev< 7:3.2.15-0+deb9u2libavfilter-dev_7:3.2.15-0+deb9u2_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	armel	libavresample3	< 7:3.2.15-0+deb9u2	libavresample3_7:3.2.15-0+deb9u2_armel.deb
Debian	10	all	ffmpeg-doc	< 7:4.1.8-0+deb10u1	ffmpeg-doc_7:4.1.8-0+deb10u1_all.deb
Debian	10	all	ffmpeg	< 7:4.1.8-0+deb10u1	ffmpeg_7:4.1.8-0+deb10u1_all.deb
Debian	9	armhf	libswresample-dev	< 7:3.2.15-0+deb9u2	libswresample-dev_7:3.2.15-0+deb9u2_armhf.deb
Debian	10	mipsel	libavcodec58-dbgsym	< 7:4.1.8-0+deb10u1	libavcodec58-dbgsym_7:4.1.8-0+deb10u1_mipsel.deb
Debian	9	armel	libswscale4	< 7:3.2.15-0+deb9u2	libswscale4_7:3.2.15-0+deb9u2_armel.deb
Debian	10	arm64	libpostproc-dev	< 7:4.1.8-0+deb10u1	libpostproc-dev_7:4.1.8-0+deb10u1_arm64.deb
Debian	9	arm64	libpostproc54	< 7:3.2.15-0+deb9u2	libpostproc54_7:3.2.15-0+deb9u2_arm64.deb
Debian	10	mipsel	libpostproc-dev	< 7:4.1.8-0+deb10u1	libpostproc-dev_7:4.1.8-0+deb10u1_mipsel.deb
Debian	9	amd64	libavfilter-dev	< 7:3.2.15-0+deb9u2	libavfilter-dev_7:3.2.15-0+deb9u2_amd64.deb