Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 537558 (CVE-2014-7937) - <media-video/ffmpeg-2.5: Two use-after-free (CVE-2014-7937)
Summary: <media-video/ffmpeg-2.5: Two use-after-free (CVE-2014-7937)
Status: RESOLVED FIXED
Alias: CVE-2014-7937
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Gentoo Security
URL: http://googlechromereleases.blogspot....
Whiteboard: A3 [glsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2015-01-24 15:50 UTC by Agostino Sarubbo
Modified: 2016-03-12 11:21 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2015-01-24 15:50:50 UTC 
From ${URL} :

[$2000][427266] High CVE-2014-7933: Use-after-free in FFmpeg. Credit to Aki 
Helin of OUSPG.
[$1500][419060] High CVE-2014-7937: Use-after-free in FFmpeg. Credit to Atte 
Kettunen of OUSPG.



@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Yury German Gentoo Infrastructure gentoo-dev 2015-07-01 12:38:24 UTC 
Fixed in 2.0.7, 2.1.6, 2.2.9, 2.3.5, 2.4.2, 2.5 

0.10.16 & 1.0.10 - Vulnerable (Not fixed as per ffmpeg page)
Could not find fixes for 1.2.X

[$2000][427266] High CVE-2014-7933: Use-after-free in FFmpeg. Credit to Aki 
Helin of OUSPG. - Google Chrome Vulnerability

2.2.14 is being stabilized bug #538798, but it is vulnerable. Setting dependency on bug #548006 - which needs to stabilize 2.2.15
Comment 2 Alexis Ballier gentoo-dev 2015-07-01 12:54:08 UTC 
(In reply to Yury German from comment #1)
> 0.10.16 & 1.0.10 - Vulnerable (Not fixed as per ffmpeg page)
> Could not find fixes for 1.2.X

yes, upstream dropped maintainance of them some time ago
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2015-07-06 12:35:34 UTC 
CVE-2014-7937 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7937):
  Multiple off-by-one errors in libavcodec/vorbisdec.c in FFmpeg before 2.4.2,
  as used in Google Chrome before 40.0.2214.91, allow remote attackers to
  cause a denial of service (use-after-free) or possibly have unspecified
  other impact via crafted Vorbis I data.
Comment 4 GLSAMaker/CVETool Bot gentoo-dev 2015-07-06 12:36:08 UTC 
CVE-2014-7937 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7937):
  Multiple off-by-one errors in libavcodec/vorbisdec.c in FFmpeg before 2.4.2,
  as used in Google Chrome before 40.0.2214.91, allow remote attackers to
  cause a denial of service (use-after-free) or possibly have unspecified
  other impact via crafted Vorbis I data.
Comment 5 GLSAMaker/CVETool Bot gentoo-dev 2016-03-12 11:21:38 UTC 
This issue was resolved and addressed in
 GLSA 201603-06 at https://security.gentoo.org/glsa/201603-06
by GLSA coordinator Kristian Fiskerstrand (K_F).