7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
31.5%
Package : libde265
Version : 1.0.3-1+deb10u1
CVE ID : CVE-2020-21599 CVE-2021-35452 CVE-2021-36408 CVE-2021-36409
CVE-2021-36410 CVE-2021-36411
Debian Bug : 1014977
Multiple issues were found in libde265, an open source implementation of the
h.265 video codec, which may result in denial of or have unspecified other
impact.
CVE-2020-21599
libde265 v1.0.4 contains a heap buffer overflow in the
de265_image::available_zscan function, which can be exploited via a crafted
a file.
CVE-2021-35452
An Incorrect Access Control vulnerability exists in libde265 v1.0.8 due to
a SEGV in slice.cc.
CVE-2021-36408
libde265 v1.0.8 contains a Heap-use-after-free in intrapred.h when decoding
file using dec265.
CVE-2021-36409
There is an Assertion `scaling_list_pred_matrix_id_delta==1' failed at
sps.cc:925 in libde265 v1.0.8 when decoding file, which allows attackers to
cause a Denial of Service (DoS) by running the application with a crafted
file or possibly have unspecified other impact.
CVE-2021-36410
A stack-buffer-overflow exists in libde265 v1.0.8 via fallback-motion.cc in
function put_epel_hv_fallback when running program dec265.
CVE-2021-36411
An issue has been found in libde265 v1.0.8 due to incorrect access control.
A SEGV caused by a READ memory access in function derive_boundaryStrength of
deblock.cc has occurred. The vulnerability causes a segmentation fault and
application crash, which leads to remote denial of service.
For Debian 10 buster, these problems have been fixed in version
1.0.3-1+deb10u1.
We recommend that you upgrade your libde265 packages.
For the detailed security status of libde265 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libde265
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 11 | mips64el | libde265-examples | < 1.0.11-0+deb11u1 | libde265-examples_1.0.11-0+deb11u1_mips64el.deb |
Debian | 11 | ppc64el | libde265-0-dbgsym | < 1.0.11-0+deb11u1 | libde265-0-dbgsym_1.0.11-0+deb11u1_ppc64el.deb |
Debian | 11 | mips64el | libde265-dev | < 1.0.11-0+deb11u1 | libde265-dev_1.0.11-0+deb11u1_mips64el.deb |
Debian | 10 | all | libde265 | < 1.0.3-1+deb10u1 | libde265_1.0.3-1+deb10u1_all.deb |
Debian | 11 | all | libde265 | < 1.0.11-0+deb11u1 | libde265_1.0.11-0+deb11u1_all.deb |
Debian | 11 | s390x | libde265-dev | < 1.0.11-0+deb11u1 | libde265-dev_1.0.11-0+deb11u1_s390x.deb |
Debian | 11 | amd64 | libde265-dev | < 1.0.11-0+deb11u1 | libde265-dev_1.0.11-0+deb11u1_amd64.deb |
Debian | 11 | armhf | libde265-0 | < 1.0.11-0+deb11u1 | libde265-0_1.0.11-0+deb11u1_armhf.deb |
Debian | 11 | arm64 | libde265-dev | < 1.0.11-0+deb11u1 | libde265-dev_1.0.11-0+deb11u1_arm64.deb |
Debian | 11 | arm64 | libde265-examples | < 1.0.11-0+deb11u1 | libde265-examples_1.0.11-0+deb11u1_arm64.deb |
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
31.5%