Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 626862 (CVE-2017-12143, CVE-2017-12145) - <media-libs/libquicktime-1.2.4-r3: Denial of Service (CVE-2017-{12145,12143})
Summary: <media-libs/libquicktime-1.2.4-r3: Denial of Service (CVE-2017-{12145,12143})
Status: RESOLVED FIXED
Alias: CVE-2017-12143, CVE-2017-12145
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: C3 [noglsa cve]
Keywords:
Depends on: 634806
Blocks:
  Show dependency tree
 
Reported: 2017-08-02 08:04 UTC by Aleksandr Wagner (Kivak)
Modified: 2018-11-25 00:11 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Aleksandr Wagner (Kivak) 2017-08-02 08:04:56 UTC
CVE-2017-12145 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12145):

In libquicktime 1.2.4, an allocation failure was found in the function quicktime_read_ftyp in ftyp.c, which allows attackers to cause a denial of service via a crafted file. 

https://somevulnsofadlab.blogspot.ca/2017/07/libquicktimeallocation-failed-in_30.html
https://sourceforge.net/p/libquicktime/mailman/message/35888849/

CVE-2017-12143 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12143):

In libquicktime 1.2.4, an allocation failure was found in the function quicktime_read_info in lqt_quicktime.c, which allows attackers to cause a denial of service via a crafted file. 

https://somevulnsofadlab.blogspot.ca/2017/07/libquicktimeallocation-failed-in.html
https://sourceforge.net/p/libquicktime/mailman/message/35888850/