SUSE CVE-2017-9123

The lqtframeduration function in lqtquicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service invalid memory read and application crash via a crafted mp4 file...

SUSE CVE-2017-9127

The quicktimeuseratomsreadatom function in useratoms.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service heap-based buffer overflow and application crash via a crafted mp4 file...

SUSE CVE-2017-9126

The quicktimereaddreftable function in dref.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service heap-based buffer overflow and application crash via a crafted mp4 file...

SUSE CVE-2017-9128

The quicktimevideowidth function in lqtquicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash via a crafted mp4 file...

SUSE CVE-2017-9616

In Wireshark 2.2.7, overly deep mp4 chunks may cause stack exhaustion uncontrolled recursion in the dissectmp4box function in epan/dissectors/file-mp4.c...

SUSE CVE-2017-14160

The barknoisehybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service out-of-bounds access and application crash or possibly have unspecified other impact via a crafted mp4 file...

SUSE CVE-2017-17670

In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules/demux/mp4/libmp4.c in the MP4 demux module leading to a invalid free, because the type of a box may be changed between a read operation and a free operation...

SUSE CVE-2022-41741

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngxhttpmp4module that might allow a local attacker to corrupt NGINX worker memory, resulting in...

SUSE CVE-2022-41742

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngxhttpmp4module that might allow a local attacker to cause a worker process crash, or might...

SUSE-SU-2023:0210-1 Security update for nginx

This update for nginx fixes the following issues: - CVE-2022-41741: Handle duplicated atoms in mp4 streams, to mitigate out-of-bound reads. bsc1204526 - CVE-2022-41742: Handle duplicated atoms in mp4 streams, to mitigate out-of-bound reads. bsc1204527...

SUSE-SU-2023:0205-1 Security update for nginx

This update for nginx fixes the following issues: - CVE-2022-41741: Handle duplicated atoms in mp4 streams, to mitigate out-of-bound reads. bsc1204526 - CVE-2022-41742: Handle duplicated atoms in mp4 streams, to mitigate out-of-bound reads. bsc1204527...

Getting the correct HTML codecs parameter for an AV1 video

This post is mostly for my own reference, but I couldn't find a good guide elsewhere, so here we go! I wanted to embed a screencast in a web page, and I wanted it to be as efficient as possible. To achieve this, I created two version of the video, and embedded it like this: The MP4 version uses t...

Debian: Security Advisory (DLA-3203-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CLSA-2022-1669066613 nginx: Fix of 2 CVEs

CVE-2022-41741: fix memory corruption in the ngxhttpmp4module - CVE-2022-41742: fix memory disclosure in the ngxhttpmp4module...

CLSA-2022-1669065718 nginx: Fix of 2 CVEs

CVE-2022-41741: fix memory corruption in the ngxhttpmp4module - CVE-2022-41742: fix memory disclosure in the ngxhttpmp4module...

CLSA-2022-1669065608 Fix CVE(s): CVE-2022-41742, CVE-2022-41741

SECURITY UPDATE: memory corruption and disclosure in MP4 streaming module - debian/patches/CVE-2022-41741-CVE-2022-41742.patch: disable duplicated atoms and ensure that the most of them appeared once in a container. - CVE-2022-41741 - CVE-2022-41742...

CLSA-2022-1669065389 nginx: Fix of 2 CVEs

CVE-2022-41741: fix memory corruption in the ngxhttpmp4module - CVE-2022-41742: fix memory disclosure in the ngxhttpmp4module...

CLSA-2022-1669065236 nginx: Fix of 2 CVEs

CVE-2022-41741: fix memory corruption in the ngxhttpmp4module - CVE-2022-41742: fix memory disclosure in the ngxhttpmp4module...

[SECURITY] [DSA 5281-1] nginx security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5281-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 15, 2022 https://www.debian.org/security/faq -...

USN-5722-1: nginx vulnerabilities

It was discovered that nginx incorrectly handled certain memory operations in the ngxhttpmp4module module. A local attacker could possibly use this issue with a specially crafted mp4 file to cause nginx to crash, stop responding, or access arbitrary memory. CVE-2022-41741, CVE-2022-41742...