Security update for ffmpeg
Announcement ID: | SUSE-SU-2019:3184-2 |
---|---|
Rating: | important |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves four vulnerabilities can now be installed.
Description:
This update for ffmpeg fixes the following issues:
Security issues fixed:
- CVE-2019-17542: Fixed a heap-buffer overflow in vqa_decode_chunk due to an
out-of-array access (bsc#1154064).
- CVE-2019-12730: Fixed an uninitialized use of variables due to an improper
check (bsc#1137526).
- CVE-2019-9718: Fixed a denial of service in the subtitle decode (bsc#1129715).
- CVE-2018-13301: Fixed a denial of service while converting a crafted AVI file
to MPEG4 (bsc#1100352).
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Package Hub 15 15-SP1
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP1-2020-1867=1
Package List:
-
SUSE Package Hub 15 15-SP1 (aarch64 ppc64le s390x x86_64)
- libavfilter6-debuginfo-3.4.2-4.27.1
- ffmpeg-debugsource-3.4.2-4.27.1
- ffmpeg-3.4.2-4.27.1
- libavfilter6-3.4.2-4.27.1
- ffmpeg-debuginfo-3.4.2-4.27.1
- libavdevice57-3.4.2-4.27.1
- libavdevice57-debuginfo-3.4.2-4.27.1
References:
- https://www.suse.com/security/cve/CVE-2018-13301.html
- https://www.suse.com/security/cve/CVE-2019-12730.html
- https://www.suse.com/security/cve/CVE-2019-17542.html
- https://www.suse.com/security/cve/CVE-2019-9718.html
- https://bugzilla.suse.com/show_bug.cgi?id=1100352
- https://bugzilla.suse.com/show_bug.cgi?id=1129715
- https://bugzilla.suse.com/show_bug.cgi?id=1137526
- https://bugzilla.suse.com/show_bug.cgi?id=1154064