Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 719940 (CVE-2019-13312, CVE-2020-12284) - <media-video/ffmpeg-4.2.3: Multiple vulnerabilities (CVE-2019-13312, CVE-2020-12284)
Summary: <media-video/ffmpeg-4.2.3: Multiple vulnerabilities (CVE-2019-13312, CVE-2020...
Status: RESOLVED FIXED
Alias: CVE-2019-13312, CVE-2020-12284
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://github.com/FFmpeg/FFmpeg/comm...
Whiteboard: B3 [glsa+ cve]
Keywords: CC-ARCHES, PullRequest
Depends on: CVE-2020-13904, CVE-2020-14212
Blocks:
  Show dependency tree
 
Reported: 2020-04-28 15:05 UTC by Sam James
Modified: 2020-07-28 19:43 UTC (History)
1 user (show)

See Also:
Package list:
=media-video/ffmpeg-4.2.3
Runtime testing required: ---
nattka: sanity-check-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James gentoo-dev Security 2020-04-28 15:05:40 UTC
Description:
"cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check."

Patch: https://github.com/FFmpeg/FFmpeg/commit/1812352d767ccf5431aa440123e2e260a4db2726
Disclosure bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19734
Comment 1 Sam James gentoo-dev Security 2020-04-28 15:06:12 UTC
@maintainer(s), please apply the supplied patch.
Comment 2 GLSAMaker/CVETool Bot gentoo-dev 2020-04-28 15:08:09 UTC
CVE-2020-12284 (https://nvd.nist.gov/vuln/detail/CVE-2020-12284):
  cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.2.2 has a
  heap-based buffer overflow during JPEG_MARKER_SOS handling because of a
  missing length check.
Comment 3 Sam James gentoo-dev Security 2020-05-23 03:20:38 UTC
A collection of other flaws found by oss-fuzz were fixed in 4.2.3.

@maintainer(s): fixed in 4.2.3. Please bump.
Comment 4 Larry the Git Cow gentoo-dev 2020-05-23 20:06:17 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fbf1dc0a317be65d039d8b9ff171571b6c721840

commit fbf1dc0a317be65d039d8b9ff171571b6c721840
Author:     Sam James (sam_c) <sam@cmpct.info>
AuthorDate: 2020-05-22 15:03:03 +0000
Commit:     Thomas Deutschmann <whissi@gentoo.org>
CommitDate: 2020-05-23 20:05:21 +0000

    media-video/ffmpeg: Security bump to 4.2.3
    
    Bug: https://bugs.gentoo.org/719940
    Package-Manager: Portage-2.3.99, Repoman-2.3.22
    Signed-off-by: Sam James (sam_c) <sam@cmpct.info>
    Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>

 media-video/ffmpeg/Manifest            |   1 +
 media-video/ffmpeg/ffmpeg-4.2.3.ebuild | 551 +++++++++++++++++++++++++++++++++
 2 files changed, 552 insertions(+)
Comment 5 Sergei Trofimovich gentoo-dev 2020-05-25 09:42:44 UTC
ppc/ppc64 stable
Comment 6 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2020-05-25 12:11:30 UTC
amd64 stable
Comment 7 Rolf Eike Beer 2020-05-30 08:51:05 UTC
sparc stable
Comment 8 Agostino Sarubbo gentoo-dev 2020-06-03 18:42:44 UTC
arm stable
Comment 9 Agostino Sarubbo gentoo-dev 2020-06-04 06:36:40 UTC
x86 stable
Comment 10 Sam James gentoo-dev Security 2020-06-08 16:52:37 UTC
arm64 stable

----
@maintainer(s), please cleanup
Comment 11 Larry the Git Cow gentoo-dev 2020-07-27 16:40:28 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5aad0c4b02393043056f044fa39114bc1aa595ae

commit 5aad0c4b02393043056f044fa39114bc1aa595ae
Author:     John Helmert III <jchelmert3@posteo.net>
AuthorDate: 2020-07-23 21:06:52 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2020-07-27 16:40:18 +0000

    media-video/ffmpeg: security cleanup (drop <4.2.4)
    
    Bug: https://bugs.gentoo.org/711144
    Bug: https://bugs.gentoo.org/718012
    Bug: https://bugs.gentoo.org/719940
    Bug: https://bugs.gentoo.org/727450
    Package-Manager: Portage-3.0.0, Repoman-2.3.23
    Signed-off-by: John Helmert III <jchelmert3@posteo.net>
    Signed-off-by: Sam James <sam@gentoo.org>

 media-video/ffmpeg/Manifest                        |   2 -
 media-video/ffmpeg/ffmpeg-3.4.6-r1.ebuild          | 490 ------------------
 media-video/ffmpeg/ffmpeg-4.2.3.ebuild             | 556 ---------------------
 media-video/ffmpeg/files/chromium.patch            |  36 --
 ...mpeg-3.4.6-fix-building-against-fdk-aac-2.patch |  74 ---
 media-video/ffmpeg/metadata.xml                    |   1 -
 6 files changed, 1159 deletions(-)
Comment 12 NATTkA bot gentoo-dev 2020-07-27 16:45:07 UTC
Unable to check for sanity:

> no match for package: =media-video/ffmpeg-4.2.3
Comment 13 Sam James gentoo-dev Security 2020-07-27 16:49:59 UTC
GLSA vote: yes, with bug 718012.
Comment 14 GLSAMaker/CVETool Bot gentoo-dev 2020-07-28 19:43:11 UTC
This issue was resolved and addressed in
 GLSA 202007-58 at https://security.gentoo.org/glsa/202007-58
by GLSA coordinator Sam James (sam_c).