| Summary: | <media-video/ffmpeg-3.3.4: NULL pointer dereference in libavutil/pixdesc.c | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | D'juan McDonald (domhnall) <flopwiki> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | minor | CC: | media-video |
| Priority: | Normal | Flags: | stable-bot:
sanity-check+
|
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-14225 | ||
| Whiteboard: | B3 [noglsa cve] | ||
| Package list: |
=media-video/ffmpeg-3.3.4
|
Runtime testing required: | --- |
| Bug Depends on: | 639698 | ||
| Bug Blocks: | 629480, 630148, 632134 | ||
---------------------------- Daj Uan (jmbailey/mbailey_j) Gentoo Security Padawan this should be fixed in 3.3.4 @maintainer(s), please let us know when you are ready to stabilize. (In reply to Aaron Bauman from comment #3) > @maintainer(s), please let us know when you are ready to stabilize. as noted in bug #630148, yes :) (In reply to Alexis Ballier from comment #4) > > as noted in bug #630148, yes :) Great, we will handle stabilization here. @Maintainers please verify if SLOT 54.56.56 is vulnerable, if that's the case, it's your decision to call sparc to the stabilization request. @Arches, please test and mark stable. Gentoo Security Padawan ChrisADR An automated check of this bug failed - repoman reported dependency errors (19 lines truncated):
> dependency.bad media-video/ffmpeg/ffmpeg-3.3.4.ebuild: DEPEND: alpha(default/linux/alpha/13.0) ['>=sci-libs/netcdf-4.3.2-r1[hdf5]', '>=net-libs/zeromq-4.1.6']
> dependency.bad media-video/ffmpeg/ffmpeg-3.3.4.ebuild: RDEPEND: alpha(default/linux/alpha/13.0) ['>=sci-libs/netcdf-4.3.2-r1[hdf5]', '>=net-libs/zeromq-4.1.6']
> dependency.bad media-video/ffmpeg/ffmpeg-3.3.4.ebuild: DEPEND: alpha(default/linux/alpha/13.0) ['>=sci-libs/netcdf-4.3.2-r1[hdf5]', '>=net-libs/zeromq-4.1.6']
(In reply to Christopher Díaz from comment #5) > @Maintainers please verify if SLOT 54.56.56 is vulnerable, if that's the > case, it's your decision to call sparc to the stabilization request. if not this bug, that's another one, but I don't expect much on the sparc side ia64 stable An automated check of this bug failed - repoman reported dependency errors (19 lines truncated):
> dependency.bad media-video/ffmpeg/ffmpeg-3.3.4.ebuild: DEPEND: alpha(default/linux/alpha/13.0) ['>=sci-libs/netcdf-4.3.2-r1[hdf5]', '>=net-libs/zeromq-4.1.6']
> dependency.bad media-video/ffmpeg/ffmpeg-3.3.4.ebuild: RDEPEND: alpha(default/linux/alpha/13.0) ['>=sci-libs/netcdf-4.3.2-r1[hdf5]', '>=net-libs/zeromq-4.1.6']
> dependency.bad media-video/ffmpeg/ffmpeg-3.3.4.ebuild: DEPEND: alpha(default/linux/alpha/13.0) ['>=sci-libs/netcdf-4.3.2-r1[hdf5]', '>=net-libs/zeromq-4.1.6']
hppa stable An automated check of this bug failed - repoman reported dependency errors (19 lines truncated):
> dependency.bad media-video/ffmpeg/ffmpeg-3.3.4.ebuild: DEPEND: alpha(default/linux/alpha/13.0) ['>=sci-libs/netcdf-4.3.2-r1[hdf5]', '>=net-libs/zeromq-4.1.6']
> dependency.bad media-video/ffmpeg/ffmpeg-3.3.4.ebuild: RDEPEND: alpha(default/linux/alpha/13.0) ['>=sci-libs/netcdf-4.3.2-r1[hdf5]', '>=net-libs/zeromq-4.1.6']
> dependency.bad media-video/ffmpeg/ffmpeg-3.3.4.ebuild: DEPEND: alpha(default/linux/alpha/13.0) ['>=sci-libs/netcdf-4.3.2-r1[hdf5]', '>=net-libs/zeromq-4.1.6']
amd64 stable An automated check of this bug failed - repoman reported dependency errors (19 lines truncated):
> dependency.bad media-video/ffmpeg/ffmpeg-3.3.4.ebuild: DEPEND: alpha(default/linux/alpha/13.0) ['>=sci-libs/netcdf-4.3.2-r1[hdf5]', '>=net-libs/zeromq-4.1.6']
> dependency.bad media-video/ffmpeg/ffmpeg-3.3.4.ebuild: RDEPEND: alpha(default/linux/alpha/13.0) ['>=sci-libs/netcdf-4.3.2-r1[hdf5]', '>=net-libs/zeromq-4.1.6']
> dependency.bad media-video/ffmpeg/ffmpeg-3.3.4.ebuild: DEPEND: alpha(default/linux/alpha/13.0) ['>=sci-libs/netcdf-4.3.2-r1[hdf5]', '>=net-libs/zeromq-4.1.6']
x86 stable An automated check of this bug failed - repoman reported dependency errors (19 lines truncated):
> dependency.bad media-video/ffmpeg/ffmpeg-3.3.4.ebuild: DEPEND: alpha(default/linux/alpha/13.0) ['>=sci-libs/netcdf-4.3.2-r1[hdf5]', '>=net-libs/zeromq-4.1.6']
> dependency.bad media-video/ffmpeg/ffmpeg-3.3.4.ebuild: RDEPEND: alpha(default/linux/alpha/13.0) ['>=sci-libs/netcdf-4.3.2-r1[hdf5]', '>=net-libs/zeromq-4.1.6']
> dependency.bad media-video/ffmpeg/ffmpeg-3.3.4.ebuild: DEPEND: alpha(default/linux/alpha/13.0) ['>=sci-libs/netcdf-4.3.2-r1[hdf5]', '>=net-libs/zeromq-4.1.6']
arm stable An automated check of this bug failed - repoman reported dependency errors (17 lines truncated):
> dependency.bad media-video/ffmpeg/ffmpeg-3.3.4.ebuild: DEPEND: alpha(default/linux/alpha/13.0) ['>=sci-libs/netcdf-4.3.2-r1[hdf5]', '>=net-libs/zeromq-4.1.6']
> dependency.bad media-video/ffmpeg/ffmpeg-3.3.4.ebuild: RDEPEND: alpha(default/linux/alpha/13.0) ['>=sci-libs/netcdf-4.3.2-r1[hdf5]', '>=net-libs/zeromq-4.1.6']
> dependency.bad media-video/ffmpeg/ffmpeg-3.3.4.ebuild: DEPEND: alpha(default/linux/alpha/13.0) ['>=sci-libs/netcdf-4.3.2-r1[hdf5]', '>=net-libs/zeromq-4.1.6']
alpha is o. @ppc/ppc64, please proceed. ppc/ppc64 stable GLSA Vote: No @maintainers, please clean the vulnerable versions. cleanup will occur in bug #639698 GLSA Vote: No |
from ${URL}: The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, but callers do not anticipate this, as demonstrated by the avcodec_string function in libavcodec/utils.c, leading to a NULL pointer dereference. (It is also conceivable that there is security relevance for a NULL pointer dereference in av_color_primaries_name calls within the ffprobe command-line program.) Upstream Patch 2/2: (https://github.com/FFmpeg/FFmpeg/commit/837cb4325b712ff1aab531bf41668933f61d75d2) (https://lists.ffmpeg.org/pipermail/ffmpeg-devel/2017-August/215198.html)