SB2018091504 - OpenSUSE Linux update for ffmpeg-4

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2018-13300)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to improper argument (AVCodecParameters) passed to the avpriv_request_sample function in the handle_eac3 function in libavformat/movenc.c. A remote attacker can supply specially crafted AVI file to MPEG4, trick the victim into converting it, trigger out-of-bounds read and cause the service to crash or possibly access arbitrary data

2) Assertion failure (CVE-ID: CVE-2018-15822)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to insufficient checks for an empty audio packet by the flv_write_packet function, as defined in the libavformat/flvenc.c source code file. A local attacker can access the system and execute a specially crafted application that submits malicious input to trigger an assertion failure and cause the service to crash.

Remediation

Install update from vendor's website.

References

• https://lists.opensuse.org/opensuse-security-announce/2018-09/msg00032.html