Bug 626862 (CVE-2017-12143, CVE-2017-12145)

Summary:	<media-libs/libquicktime-1.2.4-r3: Denial of Service (CVE-2017-{12145,12143})
Product:	Gentoo Security	Reporter:	Aleksandr Wagner (Kivak) <alwag>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	media-video
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	C3 [noglsa cve]
Package list:		Runtime testing required:	---
Bug Depends on:	634806
Bug Blocks:

Description Aleksandr Wagner (Kivak) 2017-08-02 08:04:56 UTC

CVE-2017-12145 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12145):

In libquicktime 1.2.4, an allocation failure was found in the function quicktime_read_ftyp in ftyp.c, which allows attackers to cause a denial of service via a crafted file. 

https://somevulnsofadlab.blogspot.ca/2017/07/libquicktimeallocation-failed-in_30.html
https://sourceforge.net/p/libquicktime/mailman/message/35888849/

CVE-2017-12143 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12143):

In libquicktime 1.2.4, an allocation failure was found in the function quicktime_read_info in lqt_quicktime.c, which allows attackers to cause a denial of service via a crafted file. 

https://somevulnsofadlab.blogspot.ca/2017/07/libquicktimeallocation-failed-in.html
https://sourceforge.net/p/libquicktime/mailman/message/35888850/