Summary
It was discovered that libde265 could be made to write out of bounds. If a
user or automated system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. This issue only affected Ubuntu 16.04
LTS and Ubuntu 18.04 LTS. (CVE-2020-21594)
It was discovered that libde265 could be made to write out of bounds. If a
user or automated system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. (CVE-2020-21595, CVE-2020-21596,
CVE-2020-21599, CVE-2020-21600, CVE-2020-21601, CVE-2020-21602,
CVE-2020-21603, CVE-2020-21604, CVE-2020-21605)
It was discovered that libde265 did not properly manage memory. If a user
or automated system were tricked into opening a specially crafted file, an
attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 20.04 LTS.
(CVE-2020-21597, CVE-2020-21598, CVE-2020-21606, CVE-2021-36408)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | libde265 | 1.0.4-1ubuntu0.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libde265 | 1.0.2-2ubuntu0.16.04.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libde265 | 1.0.2-2ubuntu0.18.04.1~esm1 |
Vulnerabilities 14
-
Unscored —
libde265 v1.0.4 contains a heap buffer overflow in the put_epel_hv_fallback function, which can be exploited via a craf…
-
Unscored —
libde265 v1.0.4 contains a heap buffer overflow in the mc_luma function, which can be exploited via a crafted a file.
-
Unscored —
libde265 v1.0.4 contains a global buffer overflow in the decode_CABAC_bit function, which can be exploited via a crafte…
-
Unscored —
libde265 v1.0.4 contains a heap buffer overflow in the mc_chroma function, which can be exploited via a crafted a file.
-
Unscored —
libde265 v1.0.4 contains a heap buffer overflow in the ff_hevc_put_unweighted_pred_8_sse function, which can be exploit…
-
Unscored —
libde265 v1.0.4 contains a heap buffer overflow in the de265_image::available_zscan function, which can be exploited vi…
-
Unscored —
libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_pred_avg_16_fallback function, which can be exploit…
-
Unscored —
libde265 v1.0.4 contains a stack buffer overflow in the put_qpel_fallback function, which can be exploited via a crafte…
-
Unscored —
libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_bipred_16_fallback function, which can be exploited…
-
Unscored —
libde265 v1.0.4 contains a heap buffer overflow in the put_qpel_0_0_fallback_16 function, which can be exploited via a …
-
Unscored —
libde265 v1.0.4 contains a heap buffer overflow fault in the _mm_loadl_epi64 function, which can be exploited via a cra…
-
Unscored —
libde265 v1.0.4 contains a segmentation fault in the apply_sao_internal function, which can be exploited via a crafted …
-
Unscored —
libde265 v1.0.4 contains a heap buffer overflow fault in the put_epel_16_fallback function, which can be exploited via …
-
Unscored —
An issue was discovered in libde265 v1.0.8.There is a Heap-use-after-free in intrapred.h when decoding file using dec26…
References
-
report
https://ubuntu.com/security/CVE-2020-21594
-
report
https://ubuntu.com/security/CVE-2020-21595
-
report
https://ubuntu.com/security/CVE-2020-21596
-
report
https://ubuntu.com/security/CVE-2020-21597
-
report
https://ubuntu.com/security/CVE-2020-21598
-
report
https://ubuntu.com/security/CVE-2020-21599
-
report
https://ubuntu.com/security/CVE-2020-21600
-
report
https://ubuntu.com/security/CVE-2020-21601
-
report
https://ubuntu.com/security/CVE-2020-21602
-
report
https://ubuntu.com/security/CVE-2020-21603
-
report
https://ubuntu.com/security/CVE-2020-21604
-
report
https://ubuntu.com/security/CVE-2020-21605
-
report
https://ubuntu.com/security/CVE-2020-21606
-
report
https://ubuntu.com/security/CVE-2021-36408