Bug 614016 (CVE-2016-8676, CVE-2016-9819, CVE-2016-9820, CVE-2016-9821, CVE-2016-9822, CVE-2016-9823, CVE-2016-9824, CVE-2016-9825, CVE-2016-9826)

Summary:	media-video/libav: multiple undefined behavior issues
Product:	Gentoo Security	Reporter:	Agostino Sarubbo <ago>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED OBSOLETE
Severity:	minor	CC:	itumaykin+gentoo, media-video
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://blogs.gentoo.org/ago/2016/12/01/libav-multiple-crashes-from-the-undefined-behavior-sanitizer/
Whiteboard:	B3 [ebuild/cve]
Package list:		Runtime testing required:	---

Description Agostino Sarubbo gentoo-dev

2017-03-27 09:13:20 UTC

Details at $URL.


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

Comment 1 Yury German Gentoo Infrastructure

2017-03-29 07:10:14 UTC

 CVE ID: CVE-2016-9819
   Summary: libavcodec/mpegvideo.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
 Published: 2017-03-01T15:59:00.000Z

Comment 2 Coacher 2017-05-03 07:36:41 UTC

Just a short notice that upstream released 11.9, which has these problems fixed.

Comment 3 Yury German Gentoo Infrastructure

2017-05-09 06:50:49 UTC

(In reply to Coacher from comment #2)
> Just a short notice that upstream released 11.9, which has these problems
> fixed.
Thank you!

Comment 4 Coacher 2017-05-21 17:23:44 UTC

Upstream also released 12.1 a week ago, which fixes these problems in 12.x release series. See bug 619076.

Comment 5 Agostino Sarubbo gentoo-dev

2017-06-08 15:57:56 UTC

(In reply to Coacher from comment #2)
> Just a short notice that upstream released 11.9, which has these problems
> fixed.

Only the first 4 bugs of the blgos post are fixed.

Comment 6 Yury German Gentoo Infrastructure

2019-03-28 00:09:21 UTC

Updating CVE Information:

CVE ID: CVE-2016-8676
Summary: The get_vlc2 function in get_bits.h in Libav 11.9 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted mp3 file. NOTE: this issue exists due to an incomplete fix for CVE-2016-8675.

CVE ID: CVE-2016-9819
Summary: libavcodec/mpegvideo.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.

CVE ID: CVE-2016-9820
Summary: libavcodec/mpegvideo_motion.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.

CVE ID: CVE-2016-9821
Summary: Integer overflow in libavcodec/mpegvideo_parser.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file.

CVE ID: CVE-2016-9822
Summary: Integer overflow in libavcodec/mpeg12dec.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file.

CVE ID: CVE-2016-9823
Summary: libavcodec/x86/mpegvideo.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file.

CVE ID: CVE-2016-9824
Summary: Integer overflow in libswscale/x86/swscale.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file.

CVE ID: CVE-2016-9825
Summary: libswscale/utils.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.

CVE ID: CVE-2016-9826
Summary: libavcodec/ituh263dec.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.