Summary
It was discovered that libde265 could be made to read out of bounds. If a
user or automated system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to cause a denial of
service. (CVE-2021-35452, CVE-2021-36411, CVE-2022-43238, CVE-2022-43241,
CVE-2022-43242)
It was discovered that libde265 did not properly manage memory. If a user
or automated system were tricked into opening a specially crafted file, an
attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 22.04 LTS.
(CVE-2021-36408)
It was discovered that libde265 contained a logical error. If a user
or automated system were tricked into opening a specially crafted file, an
attacker could possibly use this issue to cause a denial of service.
(CVE-2021-36409)
It was discovered that libde265 could be made to write out of bounds. If a
user or automated system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. (CVE-2021-36410, CVE-2022-43235,
CVE-2022-43236, CVE-2022-43237, CVE-2022-43239, CVE-2022-43240,
CVE-2022-43243, CVE-2022-43248, CVE-2022-43252, CVE-2022-43253)
It was discovered that libde265 could be made to write out of bounds. If a
user or automated system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. This issue only affected Ubuntu 22.04
LTS. (CVE-2022-1253)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | libde265 | 1.0.4-1ubuntu0.2 |
| Ubuntu · 22.04 LTS 22.04:LTS | libde265 | 1.0.8-1ubuntu0.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libde265 | 1.0.2-2ubuntu0.16.04.1~esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libde265 | 1.0.2-2ubuntu0.18.04.1~esm2 |
Vulnerabilities 18
-
High 7.4
Heap-based Buffer Overflow in strukturag/libde265
Heap-based Buffer Overflow in GitHub repository strukturag/libde265 prior to and including 1.0.8. The fix is established in commit 8e89fe0e175d2870c39486fdd09250b230ec10b8 but does not yet belong to an official release.
-
Medium 6.5
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_epel_pixels_8_sse i…
-
Medium 6.5
Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> i…
-
Medium 6.5
Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via void put_epel_hv_fallback<unsigned …
-
Medium 6.5
Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_h_3_v_3_sse in sse-motion.cc. This…
-
Medium 6.5
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_chroma<unsigned short> in motion.…
-
Medium 6.5
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_qpel_h_2_v_1_sse in…
-
Medium 6.5
Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_v_3_8_sse in sse-motion.cc. This v…
-
Medium 6.5
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_luma<unsigned char> in motion.cc.…
-
Medium 6.5
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_weighted_pred_avg_8_sse …
-
Medium 6.5
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_weighted_pred_avg_16_fallback in…
-
Medium 6.5
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_16_fallback in fallback-mot…
-
Medium 6.5
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_unweighted_pred_16_fallback in f…
-
Unscored —
An Incorrect Access Control vulnerability exists in libde265 v1.0.8 due to a SEGV in slice.cc.
-
Unscored —
An issue was discovered in libde265 v1.0.8.There is a Heap-use-after-free in intrapred.h when decoding file using dec26…
-
Unscored —
There is an Assertion `scaling_list_pred_matrix_id_delta==1' failed at sps.cc:925 in libde265 v1.0.8 when decoding file…
-
Unscored —
A stack-buffer-overflow exists in libde265 v1.0.8 via fallback-motion.cc in function put_epel_hv_fallback when running …
-
Unscored —
An issue has been found in libde265 v1.0.8 due to incorrect access control. A SEGV caused by a READ memory access in fu…
References
-
report
https://ubuntu.com/security/CVE-2021-35452
-
report
https://ubuntu.com/security/CVE-2021-36408
-
report
https://ubuntu.com/security/CVE-2021-36409
-
report
https://ubuntu.com/security/CVE-2021-36410
-
report
https://ubuntu.com/security/CVE-2021-36411
-
report
https://ubuntu.com/security/CVE-2022-1253
-
report
https://ubuntu.com/security/CVE-2022-43235
-
report
https://ubuntu.com/security/CVE-2022-43236
-
report
https://ubuntu.com/security/CVE-2022-43237
-
report
https://ubuntu.com/security/CVE-2022-43238
-
report
https://ubuntu.com/security/CVE-2022-43239
-
report
https://ubuntu.com/security/CVE-2022-43240
-
report
https://ubuntu.com/security/CVE-2022-43241
-
report
https://ubuntu.com/security/CVE-2022-43242
-
report
https://ubuntu.com/security/CVE-2022-43243
-
report
https://ubuntu.com/security/CVE-2022-43248
-
report
https://ubuntu.com/security/CVE-2022-43252
-
report
https://ubuntu.com/security/CVE-2022-43253