[SECURITY] [DLA 1899-1] faad2 security update

Package : faad2 Version : 2.7-8+deb8u3 CVE ID : CVE-2018-19502 CVE-2018-20196 CVE-2018-20199 CVE-2018-20360 CVE-2019-6956 CVE-2019-15296 Debian Bug : 914641 Multiple vulnerabilities have been discovered in faad2, the Freeware Advanced Audio Coder: CVE-2018-19502 Heap buffer overflow in the functi...

CVE-2019-15574

Gesior-AAC before 2019-05-01 allows serviceID SQL injection in accountmanagement.php...

CVE-2019-15572

Gesior-AAC before 2019-05-01 allows ServiceCategoryID SQL injection in shop.php...

CVE-2019-15573

Gesior-AAC before 2019-05-01 allows SQL injection in tankyou.php...

CVE-2019-15573

Gesior-AAC before 2019-05-01 allows SQL injection in tankyou.php...

CVE-2019-15574

Gesior-AAC before 2019-05-01 allows serviceID SQL injection in accountmanagement.php...

CVE-2019-15572

Gesior-AAC before 2019-05-01 allows ServiceCategoryID SQL injection in shop.php...

Sql injection

Gesior-AAC before 2019-05-01 allows SQL injection in tankyou.php...

Sql injection

Gesior-AAC before 2019-05-01 allows ServiceCategoryID SQL injection in shop.php...

Sql injection

Gesior-AAC before 2019-05-01 allows serviceID SQL injection in accountmanagement.php...

CVE-2019-15572

Gesior-AAC before 2019-05-01 allows ServiceCategoryID SQL injection in shop.php...

CVE-2019-15572

The CVE-2019-15572 entry describes an SQL injection in Gesior-AAC’s shop.php, affecting versions prior to 2019-05-01. Root cause cited in CNVD-2019-31345 notes lack of validation for externally entered SQL statements in database-driven apps, enabling an attacker to execute arbitrary SQL commands....

CVE-2019-15573

Gesior-AAC contains an SQL injection vulnerability in tankyou.php for builds before 2019-05-01. The CVE-2019-15573 entry is corroborated by multiple sources (e.g., NVD) with a high/critical severity (CVSS 2.0 base 7.5; CVSS 3.0 base 9.8). The provided connected documents confirm the affected comp...

CVE-2019-15573

Gesior-AAC before 2019-05-01 allows SQL injection in tankyou.php...

CVE-2019-15574

Gesior-AAC before 2019-05-01 allows serviceID SQL injection in accountmanagement.php...

CVE-2019-15574

Gesior-AAC before 2019-05-01 has a serviceID SQL injection in accountmanagement.php. Root cause: lack of validation/sanitization of externally entered SQL statements in a database-based application. Impact: allows execution of arbitrary SQL commands (partial/high confidentiality, integrity, and a...

libfdk-aac/aacDecoder_DecodeFrame: Stack-buffer-overflow in calcAvgGain

Detailed report: https://oss-fuzz.com/testcase?key=5693677388693504 Project: libfdk-aac Fuzzer: libFuzzerlibfdk-aacaacDecoderDecodeFrame Fuzz target binary: aacDecoderDecodeFrame Job Type: libfuzzerasanlibfdk-aac Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address:...

libfdk-aac/aacDecoder_DecodeFrame: Index-out-of-bounds in processDrcTime

Detailed report: https://oss-fuzz.com/testcase?key=5744919487971328 Project: libfdk-aac Fuzzer: libFuzzerlibfdk-aacaacDecoderDecodeFrame Fuzz target binary: aacDecoderDecodeFrame Job Type: libfuzzerubsanlibfdk-aac Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

libfdk-aac/aacDecoder_DecodeFrame: Index-out-of-bounds in prepareDrcGain

Detailed report: https://oss-fuzz.com/testcase?key=5632456541077504 Project: libfdk-aac Fuzzer: libFuzzerlibfdk-aacaacDecoderDecodeFrame Fuzz target binary: aacDecoderDecodeFrame Job Type: libfuzzerubsanlibfdk-aac Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

[SECURITY] Fedora 29 Update: mediainfo-19.04-1.fc29

MediaInfo CLI Command Line Interface. What information can I get from MediaInfo? General: title, author, director, album, track number, date, duration... Video: codec, aspect, fps, bitrate... Audio: codec, sample rate, channels, language, bitrate... Text: language of subtitle Chapters: number of...