Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 520132 (CVE-2014-5271) - <media-video/ffmpeg-2.2.7: Multiple vulnerabilities (CVE-2014-{5271,5272})
Summary: <media-video/ffmpeg-2.2.7: Multiple vulnerabilities (CVE-2014-{5271,5272})
Status: RESOLVED FIXED
Alias: CVE-2014-5271
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: http://seclists.org/oss-sec/2014/q3/371
Whiteboard: B3 [glsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2014-08-17 14:50 UTC by Kristian Fiskerstrand (RETIRED)
Modified: 2016-03-12 11:21 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Kristian Fiskerstrand (RETIRED) gentoo-dev 2014-08-17 14:50:41 UTC
From ${URL}:
Hi,

I would like to request CVEs for the following issues:

http://git.videolan.org/?p=ffmpeg.git;a=commit;h=52b81ff4635c077b2bc8b8d3637d933b6629d803
fixes asseration failure in prores_ks encoder
https://trac.ffmpeg.org/ticket/2760
Found-by: MarkZV

http://git.videolan.org/?p=ffmpeg.git;a=commit;h=3539d6c63a16e1b2874bb037a86f317449c58770
fixes out of array access in iff decoder
Found-by: Piotr Bandurski
Comment 1 GLSAMaker/CVETool Bot gentoo-dev 2015-01-10 15:41:19 UTC
CVE-2014-5272 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-5272):
  libavcodec/iff.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.2.x before
  2.2.7, and 2.3.x before 2.3.2 allows remote attackers to have unspecified
  impact via a crafted iff image, which triggers an out-of-bounds array
  access, related to the rgb8 and rgbn formats.

CVE-2014-5271 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-5271):
  Heap-based buffer overflow in the encode_slice function in
  libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8,
  2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote
  attackers to cause a denial of service (crash) or possibly execute arbitrary
  code via unspecified vectors.
Comment 2 Alexis Ballier gentoo-dev 2015-02-15 10:30:35 UTC
http://ffmpeg.org/security.html marks it as fixed in 2.2.7 for the 2.2 branch, we'll go with 2.2.12+ since 1.2 (current stable) is not maintained anymore
Comment 3 Yury German Gentoo Infrastructure gentoo-dev 2015-07-01 13:04:13 UTC
Highest Version of Fixes for CVE's -  1.1.14, 1.2.8, 2.1.6, 2.2.7

Since 1.1.X and 1.2.X is no longer maintained and 
2.2.14 is being stabilized, but higher version without bugs is 2.2.15. Once stabilized we can clean up 1.1.x and 1.2.x

Setting dependency on: 548006
Comment 4 GLSAMaker/CVETool Bot gentoo-dev 2016-03-12 11:21:23 UTC
This issue was resolved and addressed in
 GLSA 201603-06 at https://security.gentoo.org/glsa/201603-06
by GLSA coordinator Kristian Fiskerstrand (K_F).