[SECURITY] [DLA 3240-1] libde265 security update

Debian LTS Advisory DLA-3240-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost December 15, 2022 https://wiki.debian.org/LTS Package : libde265 Version : 1.0.3-1+deb10u1 CVE ID : CVE-2020-21599 CVE-2021-35452 CVE-2021-36408 CVE-2021-36409 CVE-2021-36410 CVE-2021-3641...

The vulnerability of the mc_chroma function in the h.265 Libde265 video codec implementation, which allows a hacker to cause a service failure.

The vulnerability of the mcchroma function in the h.265 Libde265 video codec is related to writing beyond the buffer boundaries. Exploiting this vulnerability allows a remote attacker to cause a service failure using a specially created file...

libde265 resource management error vulnerability

Libde265 is a German h.265 video codec. libde265 suffers from a resource management error vulnerability that stems from a Heap-use-after-free in intrapred.h when decoding files using dec265. No detailed vulnerability details are available...

libde265 has an unspecified vulnerability

Libde265 is a German h.265 video codec. libde265 suffers from a security vulnerability that could be exploited by an attacker to cause a denial of service DoS by running a crafted file or application with unspecified other impact...

libde265 Access Control Error Vulnerability (CNVD-2022-19083)

Libde265 is a German h.265 video codec. libde265 is vulnerable to an access control error, and no detailed vulnerability details are currently available...

libde265 Heap Buffer Overflow Vulnerability (CNVD-2021-78434)

libde265 is an open source implementation of the h.265 video codec. libde265 version 1.0.4 has a heap buffer overflow vulnerability in the putweightedbipred16fallback function. An attacker can exploit the vulnerability to cause a denial of service via specially crafted files...

libde265 Heap Buffer Overflow Vulnerability

libde265 is an open source implementation of the h.265 video codec. libde265 version 1.0.4 contains a heap buffer overflow vulnerability in the putepel16fallback function. An attacker can exploit the vulnerability to cause a denial of service via specially crafted files...

libde265 heap buffer overflow vulnerability (CNVD-2021-78426)

libde265 is an open source implementation of the h.265 video codec. A heap buffer overflow vulnerability exists in the putepelhvfallback function in libde265 version 1.0.4. An attacker can exploit this vulnerability via specially crafted files to cause a denial of service...

libde265 Heap Buffer Overflow Vulnerability (CNVD-2021-79732)

libde265 is an open source implementation of the h.265 video codec. libde265 version 1.0.4 contains a heap buffer overflow vulnerability in the putqpel00fallback16 function. An attacker can exploit the vulnerability to cause a denial of service via specially crafted files...

libde265 Heap Buffer Overflow Vulnerability (CNVD-2021-78432)

libde265 is an open source implementation of the h.265 video codec. libde265 version 1.0.4 contains a heap buffer overflow vulnerability in the putweightedpredavg16fallback function. An attacker can exploit the vulnerability to cause a denial of service via specially crafted files...

libde265 Global Buffer Overflow Vulnerability

libde265 is an open source implementation of the h.265 video codec. libde265 version 1.0.4 contains a global buffer overflow vulnerability in the decodeCABACbit function. An attacker can exploit this vulnerability via specially crafted files to cause a denial of service...

libde265 Heap Buffer Overflow Vulnerability (CNVD-2021-78430)

libde265 is an open source implementation of the h.265 video codec. libde265 version 1.0.4 contains a heap buffer overflow vulnerability in the ffhevcputunweightedpred8sse function. An attacker can exploit the vulnerability to cause a denial of service via specially crafted files...

libde265 Heap Buffer Overflow Vulnerability (CNVD-2021-78431)

libde265 is an open source implementation of the h.265 video codec. libde265 version 1.0.4 contains a heap buffer overflow vulnerability in the de265image::availablezscan function. An attacker can exploit this vulnerability via specially crafted files to cause a denial of service...

libde265 Heap Buffer Overflow Vulnerability (CNVD-2021-78429)

libde265 is an open source implementation of the h.265 video codec. libde265 version 1.0.4 contains a heap buffer overflow vulnerability in the mcchroma function. An attacker can exploit the vulnerability to cause a denial of service via specially crafted files...

USN-4809-1: VideoLAN x265 vulnerability

It was discovered that VideoLAN x265 mishandled certain memory-allocation inputs. An attacker could use this vulnerability to cause a denial of service crash...

Understanding Emerging Video Formats

In my previous post, we discussed two new image formats: High-Efficiency Image File HEIF and AV1 Image File AVIF. In this article, we'll take a closer look at two emerging video formats built on the same foundations. Akamai Image & Video Manager IVM already supports the key video codecs H.264,...

CVE-2020-24217

An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpoint does not enforce authentication. Attackers can send an unauthenticated HTTP request to upload a custom firmware component, possibly in conjunction with command injection, to...

Path traversal

An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can send crafted unauthenticated HTTP requests to exploit path traversal and pattern-matching programming flaws, and retrieve any file from the device's file system, including the configuration file with t...

CVE-2020-24218

CVE-2020-24218 affects URayTech IPTV/H.264/H.265 video encoders (up to version 1.97). The issue allows an unauthenticated remote attacker to log in as root using a hard-coded password embedded in the executable, effectively granting full control over the device. Documents indicate this involves d...

CVE-2020-24217

HiSilicon IPTV/H.264/H.265 video encoder devices are affected by CVE-2020-24217 due to an unauthenticated file-upload endpoint that can upload a custom firmware component, potentially coupled with command injection, to achieve arbitrary code execution. The connected sources (exploit-DB entries, C...