Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Mageia 2019-0029 Moderate: Live Denial-Of-Service And Buffer Overflow

mageia
Calendar Grey January 10, 2019
Dist Mageia Esm H88
Mageia 2020-0030 upgrades live, ffmpeg, mplayer, and vlc to address denial-of-service and buffer overflow vulnerabilities.
A bug in the server implementation of RTSP-over-HTTP in live could allow a denial-of-service attack

Summary

A bug in the server implementation of RTSP-over-HTTP in live could allow a denial-of-service attack.
A bug in the server implementation of RTSP-over-HTTP could allow a buffer overflow, which could result in the execution of arbitrary code when parsing a malformed RTSP stream (CVE-2018-4013).
The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 3.3.8 does not check for an empty audio packet, leading to an assertion failure (CVE-2018-15822).
The live package has been updated to version 2018.11.26, the ffmpeg package has been updated to version 3.3.9, and the vlc package has been updated to version 3.0.5, fixing these issues and other bugs.
The mplayer package has been rebuilt against the update live package to fix the RTSP-over-HTTP issues in mplayer.

References

- https://bugs.mageia.org/show_bug.cgi?id=24071

-

- https://code.videolan.org/videolan/vlc-3.0/-/raw/master/NEWS

- https://lists.debian.org/debian-security-announce/2018/msg00275.html

- https://www.cve.org/CVERecord?id=CVE-2018-4013

- https://www.cve.org/CVERecord?id=CVE-2018-15822

Topics%20covered

Topics Covered

security advisory buffer overflow denial-of-service ffmpeg vlc Mageia live package

Resolution

SRPMS

- 6/tainted/ffmpeg-3.3.9-1.mga6.tainted

- 6/tainted/mplayer-1.3.0-13.mga6.tainted

- 6/tainted/vlc-3.0.5-2.mga6.tainted

- 6/core/live-2018.11.26-1.mga6

- 6/core/ffmpeg-3.3.9-1.mga6

- 6/core/mplayer-1.3.0-13.mga6

- 6/core/vlc-3.0.5-2.mga6

Severity
important
Lowest
Low
Medium
High
Critical

Publication date: 10 Jan 2019
URL: https://advisories.mageia.org/MGASA-2019-0029.html
Type: security
CVE: CVE-2018-4013, CVE-2018-15822

Topics%20covered

Topics Covered

security advisory buffer overflow denial-of-service ffmpeg vlc Mageia live package

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here