SB2024072115 - openEuler 22.03 LTS SP4 update for ffmpeg

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Integer overflow (CVE-ID: CVE-2021-28429)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow within the av_timecode_make_string in libavutil/timecode.c. A local user can pass specially crafted data to the application, trigger integer overflow and cause a denial of service condition on the target system.

2) NULL pointer dereference (CVE-ID: CVE-2022-3341)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the decode_main_header() function in libavformat/nutdec.c A remote attacker can trick the victim to open a specially crafted file and perform a denial of service (DoS) attack.

3) Buffer overflow (CVE-ID: CVE-2016-6432)

The vulnerability allows a remote unauthenticated user to execute arbitrary code on the target system.
The weakness is caused by improper checking of the input. By returning a specially crafted NetBIOS packet via IPv4 in response to a NetBIOS probe sent by the target system, attackers can trigger a buffer overflow that lets execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1831