SB2017032108 - Multiple vulnerabilities in Libav

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2017-5984)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to heap-based buffer over-read. A remote attacker can perform a denial of service attack.

2) Out-of-bounds read (CVE-ID: CVE-2017-7206)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in The ff_h2645_extract_rbsp function in libavcodec in libav 9.21. A remote attacker can perform a denial of service (heap-based buffer over-read) or obtain sensitive information from process memory via a crafted h264 video file.

3) Out-of-bounds read (CVE-ID: CVE-2017-7208)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in The decode_residual function in libavcodec in libav 9.21. A remote attacker can perform a denial of service (buffer over-read) or obtain sensitive information from process memory via a crafted h264 video file.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://bugzilla.libav.org/show_bug.cgi?id=1019
• https://patches.libav.org/patch/62534/
• http://www.securityfocus.com/bid/97006
• https://bugzilla.libav.org/show_bug.cgi?id=1002
• http://www.debian.org/security/2017/dsa-4012
• http://www.securityfocus.com/bid/97005
• https://bugzilla.libav.org/show_bug.cgi?id=1000