Debian 9: DLA-1850-1 Moderate: libav Security Vulnerabilities Found

CVE-2015-1872

The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c did not
validate the number of components in a JPEG-LS Start Of Frame
segment, which allowed remote attackers to cause a denial of service
(out-of-bounds array access) or possibly have unspecified other
impact via crafted Motion JPEG data.

CVE-2017-14058

The read_data function in libavformat/hls.c did not restrict reload
attempts for an insufficient list, which allowed remote attackers to
cause a denial of service (infinite loop).

CVE-2017-1000460

In get_last_needed_nal() (libavformat/h264.c) the return value of
init_get_bits was ignored and get_ue_golomb(&gb) was called on an
uninitialized get_bits context, which caused a NULL deref exception.

CVE-2018-6392

The filter_slice function in libavfilter/vf_transpose.c allowed
remote attackers to cause a denial of service (out-of-array access)
via a crafted MP4 file.

CVE-2018-1999012