Summary
It was discovered that libde265 could be made to write out of bounds. If a
user or automated system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. (CVE-2022-43244, CVE-2022-43249,
CVE-2022-43250, CVE-2022-47665, CVE-2023-25221)
It was discovered that libde265 could be made to read out of bounds. If a
user or automated system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to cause a denial of
service. (CVE-2022-43245)
It was discovered that libde265 could be made to dereference invalid
memory. If a user or automated system were tricked into opening a specially
crafted file, an attacker could possibly use this issue to cause a denial
of service. (CVE-2023-24751, CVE-2023-24752, CVE-2023-24754,
CVE-2023-24755, CVE-2023-24756, CVE-2023-24757, CVE-2023-24758)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | libde265 | 1.0.4-1ubuntu0.3 |
| Ubuntu · 22.04 LTS 22.04:LTS | libde265 | 1.0.8-1ubuntu0.2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libde265 | 1.0.2-2ubuntu0.16.04.1~esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libde265 | 1.0.2-2ubuntu0.18.04.1~esm3 |
Vulnerabilities 13
-
High 7.8
Libde265 1.0.9 has a heap buffer overflow vulnerability in de265_image::set_SliceAddrRS(int, int, int)
-
Medium 6.5
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in…
-
Medium 6.5
Libde265 v1.0.8 was discovered to contain a segmentation violation via apply_sao_internal<unsigned short> in sao.cc. Th…
-
Medium 6.5
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_hv_fallback<unsigned short>…
-
Medium 6.5
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_0_0_fallback_16 in fallback…
-
Medium 5.5
libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_weighted_pred_avg_8_sse functi…
-
Medium 5.5
libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put_weighted_pred_8_fallback function at f…
-
Medium 5.5
libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_unweighted_pred_8_sse function…
-
Medium 5.5
libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put_unweighted_pred_16_fallback function a…
-
Medium 5.5
libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_weighted_pred_avg_8_sse functi…
-
Unscored —
libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the mc_chroma function at motion.cc. This vuln…
-
Unscored —
libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_hevc_epel_pixels_8_sse functio…
-
Unscored —
Libde265 v1.0.10 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_predi…
References
-
report
https://ubuntu.com/security/CVE-2022-43244
-
report
https://ubuntu.com/security/CVE-2022-43245
-
report
https://ubuntu.com/security/CVE-2022-43249
-
report
https://ubuntu.com/security/CVE-2022-43250
-
report
https://ubuntu.com/security/CVE-2022-47665
-
report
https://ubuntu.com/security/CVE-2023-24751
-
report
https://ubuntu.com/security/CVE-2023-24752
-
report
https://ubuntu.com/security/CVE-2023-24754
-
report
https://ubuntu.com/security/CVE-2023-24755
-
report
https://ubuntu.com/security/CVE-2023-24756
-
report
https://ubuntu.com/security/CVE-2023-24757
-
report
https://ubuntu.com/security/CVE-2023-24758
-
report
https://ubuntu.com/security/CVE-2023-25221