Alerts This Week
Warning Icon 1 923
Alerts This Week
Warning Icon 1 923

Debian LTS DLA-2291-1 Critical: FFmpeg Buffer Overflow Fix

debian lts
Calendar Grey July 27, 2020
Dist Debian Esm H88
Enhance your FFmpeg installations to mitigate multiple vulnerabilities highlighted in Debian Security Notice DLA-2291-1.
Several vulnerabilities have been fixed by upgrading FFmpeg, a widely used multimedia framework, from 3.2.14 to 3.2.15
Topics%20covered

Topics Covered

security advisory buffer overflow debian heap overflow ffmpeg multimedia framework raw muxer

Summary

rawenc: Only accept the appropriate stream type for raw muxers.

CVE-2019-17542

Heap-based buffer overflow in vqa_decode_chunk.

CVE-2020-13904

Use-after-free via a crafted EXTINF duration in an m3u8 file.

For Debian 9 stretch, these problems have been fixed in version
7:3.2.15-0+deb9u1.

Several other bugs are also fixed in 3.2.15,
a full list of changes is available at


We recommend that you upgrade your ffmpeg packages.

For the detailed security status of ffmpeg please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/ffmpeg

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Severity
critical
Lowest
Low
Medium
High
Critical

-------------------------------------------------------------------------Package: ffmpeg
Version: 7:3.2.15-0+deb9u1
CVE ID: CVE-2019-13390 CVE-2019-17542 CVE-2020-13904
Debian Bug:

Topics%20covered

Topics Covered

security advisory buffer overflow debian heap overflow ffmpeg multimedia framework raw muxer

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here