Register | Log in

libav

Choose email to subscribe with

general

source: libav (updates)
version: 6:11.12-1~deb8u5
maintainer: Debian Multimedia Maintainers (archive) [DMD]
uploaders: Loïc Minier [DMD] – Jonas Smedegaard [DMD] – Sebastian Ramacher [DMD] – Sam Hocevar (Debian packages) [DMD] – Fabian Greffrath [DMD] – Reinhard Tartler [DMD]
arch: all any
std-ver: 3.9.5
VCS: Git (Browse)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 6:0.8.17-2
o-o-sec: 6:0.8.21-0+deb7u1
o-o-bpo: 6:10.1-1~bpo70+1
oldstable: 6:11.12-1~deb8u1
old-sec: 6:11.12-1~deb8u5

versioned links

6:0.8.17-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6:0.8.21-0+deb7u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6:10.1-1~bpo70+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6:11.12-1~deb8u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6:11.12-1~deb8u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libav-dbg
libav-doc
libav-tools
libavcodec-dev
libavcodec-extra
libavcodec-extra-56
libavcodec56
libavdevice-dev
libavdevice55
libavfilter-dev
libavfilter5
libavformat-dev
libavformat56
libavresample-dev
libavresample2
libavutil-dev
libavutil54
libswscale-dev
libswscale3

package is gone

This package is not in any development repository. This probably means that the package has been removed (or has been renamed). Thus the information here is of little interest ... the package is going to disappear unless someone takes it over and reintroduces it.

action needed

25 security issues in jessie high

There are 25 open security issues in jessie.

13 important issues:

CVE-2018-19128: In Libav 12.3, there is a heap-based buffer over-read in decode_frame in libavcodec/lcldec.c that allows an attacker to cause denial-of-service via a crafted avi file.
CVE-2018-19130: In Libav 12.3, there is an invalid memory access in vc1_decode_frame in libavcodec/vc1dec.c that allows attackers to cause a denial-of-service via a crafted aac file.
CVE-2018-11102: An issue was discovered in Libav 12.3. A read access violation in the mov_probe function in libavformat/mov.c allows remote attackers to cause a denial of service (application crash), as demonstrated by avconv.
CVE-2018-5766: In Libav through 12.2, there is an invalid memcpy in the av_packet_ref function of libavcodec/avpacket.c. Remote attackers could leverage this vulnerability to cause a denial of service (segmentation fault) via a crafted avi file.
CVE-2018-19129: In Libav 12.3, a NULL pointer dereference (RIP points to zero) issue in ff_mpa_synth_filter_float in libavcodec/mpegaudiodsp_template.c can cause a segmentation fault (application crash) via a crafted mov file.
CVE-2018-18829: There exists a NULL pointer dereference in ff_vc1_parse_frame_header_adv in vc1.c in Libav 12.3, which allows attackers to cause a denial-of-service through a crafted aac file.
CVE-2017-17128: The h264_slice_init function in libavcodec/h264_slice.c in Libav 12.2 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted file.
CVE-2017-1000460: In line libavcodec/h264dec.c:500 in libav(v13_dev0), ffmpeg(n3.4), chromium(56 prior Feb 13, 2017), the return value of init_get_bits is ignored and get_ue_golomb(&gb) is called on an uninitialized get_bits context, which causes a NULL deref exception.
CVE-2018-6392: The filter_slice function in libavfilter/vf_transpose.c in FFmpeg through 3.4.1 allows remote attackers to cause a denial of service (out-of-array access) via a crafted MP4 file.
CVE-2018-1999012: FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later.
CVE-2018-11224: An issue was discovered in Libav 12.3. A read access violation in the in_table_init16 function in libavcodec/aacsbr.c allows remote attackers to cause a denial of service (application crash), as demonstrated by avconv.
CVE-2017-9987: There is a heap-based buffer overflow in the function hpel_motion in mpegvideo_motion.c in libav 12.1. A crafted input can lead to a remote denial of service attack.
CVE-2017-14058: In FFmpeg 3.3.3, the read_data function in libavformat/hls.c does not restrict reload attempts for an insufficient list, which allows remote attackers to cause a denial of service (infinite loop).

12 issues skipped by the security teams:

CVE-2018-20001: In Libav 12.3, there is a floating point exception in the range_decode_culshift function (called from range_decode_bits) in libavcodec/apedec.c that will lead to remote denial of service via crafted input.
CVE-2016-5115: The avcodec_decode_audio4 function in libavcodec in libavformat 57.34.103, as used in MPlayer, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mp3 file.
CVE-2017-18247: The av_audio_fifo_size function in libavutil/audio_fifo.c in Libav 12.2 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted media file.
CVE-2015-1872: The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Motion JPEG data.
CVE-2016-9823: libavcodec/x86/mpegvideo.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file.
CVE-2017-17127: The vc1_decode_frame function in libavcodec/vc1dec.c in Libav 12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.
CVE-2017-18242: The apply_dependent_coupling function in libavcodec/aacdec.c in Libav 12.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted aac file.
CVE-2017-18246: The pcm_encode_frame function in libavcodec/pcm.c in Libav 12.2 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted media file.
CVE-2017-18244: The stereo_processing function in libavcodec/aacps.c in Libav 12.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted aac file, related to ff_ps_apply.
CVE-2017-18245: The mpc8_probe function in libavformat/mpc8.c in Libav 12.2 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted audio file.
CVE-2017-18243: The unpack_parse_unit function in libavcodec/dirac_parser.c in Libav 12.2 allows remote attackers to cause a denial of service (segmentation fault) via a crafted file.
CVE-2016-9824: Integer overflow in libswscale/x86/swscale.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file.

Please fix them.

Created: 2015-07-16 Last update: 2019-02-01 02:47

news

[2019-01-31] Accepted libav 6:11.12-1~deb8u5 (source all amd64) into oldstable (Mike Gabriel)
[2019-01-07] Accepted libav 6:11.12-1~deb8u4 (source all amd64) into oldstable (Markus Koschany)
[2018-12-20] Accepted libav 6:11.12-1~deb8u3 (source all amd64) into oldstable (Mike Gabriel)
[2018-12-20] Accepted libav 6:11.12-1~deb8u2 (source all amd64) into oldstable (Mike Gabriel)
[2018-02-23] Accepted libav 6:11.12-1~deb8u1 (source all amd64) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Sebastian Ramacher)
[2017-11-18] Accepted libav 6:11.11-1~deb8u1 (source all amd64) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Hugo Lefeuvre)
[2017-10-21] Accepted libav 6:0.8.21-0+deb7u1 (source amd64 all) into oldoldstable (Hugo Lefeuvre)
[2017-04-28] Accepted libav 6:11.9-1~deb8u1 (source all amd64) into proposed-updates->stable-new, proposed-updates (Sebastian Ramacher)
[2017-01-19] Accepted libav 6:0.8.20-0+deb7u1 (source amd64 all) into oldstable (Hugo Lefeuvre)
[2017-01-12] Accepted libav 6:0.8.19-0+deb7u1 (source amd64 all) into oldstable (Hugo Lefeuvre)
[2016-10-08] Accepted libav 6:11.8-1~deb8u1 (source all amd64) into proposed-updates->stable-new, proposed-updates (Sebastian Ramacher)
[2016-10-04] Accepted libav 6:0.8.18-0+deb7u1 (source amd64 all) into oldstable (Hugo Lefeuvre)
[2016-06-17] Accepted libav 6:11.7-1~deb8u1 (source all amd64) into proposed-updates->stable-new, proposed-updates (Sebastian Ramacher)
[2016-06-14] Accepted libav 6:0.8.17-2+deb7u2 (source amd64 all) into oldstable (signed by: Chris Lamb)
[2016-05-10] Accepted libav 6:0.8.17-2+deb7u1 (source amd64 all) into oldstable (signed by: Chris Lamb)
[2016-03-05] Accepted libav 6:0.8.17-2 (source amd64 all) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Sebastian Ramacher)
[2016-03-05] Accepted libav 6:11.6-1~deb8u1 (source all amd64) into proposed-updates->stable-new, proposed-updates (Sebastian Ramacher)
[2015-09-06] libav REMOVED from testing (Britney)
[2015-08-29] Removed 6:11.4-2 from unstable
[2015-07-30] Accepted libav 6:11.4-1~deb8u1 (source all) into proposed-updates->stable-new, proposed-updates (Sebastian Ramacher)
[2015-06-09] libav 6:11.4-2 MIGRATED to testing (Britney)
[2015-06-03] Accepted libav 6:11.4-2 (source all) into unstable (Sebastian Ramacher)
[2015-06-03] libav 6:11.4-1 MIGRATED to testing (Britney)
[2015-05-31] Accepted libav 6:11.4-1 (source amd64 all) into unstable (Reinhard Tartler)
[2015-05-24] Accepted libav 6:11.3-1+deb8u1 (source all) into proposed-updates->stable-new, proposed-updates (Sebastian Ramacher)
[2015-05-12] libav 6:11.3-3 MIGRATED to testing (Britney)
[2015-05-05] Accepted libav 6:11.3-3 (source all) into unstable (Sebastian Ramacher)
[2015-05-02] libav 6:11.3-2 MIGRATED to testing (Britney)
[2015-04-26] Accepted libav 6:11.3-2 (source all) into unstable (Sebastian Ramacher)
[2015-03-19] libav 6:11.3-1 MIGRATED to testing (Britney)

1
2

bugs [bug history graph]

all: 0

links

homepage
buildd: logs, clang
popcon
browse source code
edit tags
security tracker

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing