Vulnerabilities > CVE-2015-8216 - Code vulnerability in Ffmpeg
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain width and height checks, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family SuSE Local Security Checks NASL id OPENSUSE-2015-821.NASL description The ffmpeg package was updated to version 2.8.2 to fix the following security and non security issues : - CVE-2015-8216: Fixed the ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c which could cause a denial of service (out-of-bounds array access) (bnc#955346). - CVE-2015-8217: Fixed the ff_hevc_parse_sps function in libavcodec/hevc_ps.c which could cause a denial of service (out-of-bounds array access) (bnc#955347). - CVE-2015-8218: Fixed the decode_uncompressed function in libavcodec/faxcompr.c which could cause a denial of service (out-of-bounds array access) (bnc#955348). - CVE-2015-8219: Fixed the init_tile function in libavcodec/jpeg2000dec.c which could cause a denial of service (out-of-bounds array access) (bnc#955350). - Update to new upstream release 2.8.2 - various fixes in the aac_fixed decoder - various fixes in softfloat - swresample/resample: increase precision for compensation - lavf/mov: add support for sidx fragment indexes - avformat/mxfenc: Only store user comment related tags when needed - ffmpeg: Don last seen 2020-06-05 modified 2015-11-30 plugin id 87085 published 2015-11-30 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/87085 title openSUSE Security Update : ffmpeg (openSUSE-2015-821) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2015-821. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(87085); script_version("2.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2015-8216", "CVE-2015-8217", "CVE-2015-8218", "CVE-2015-8219"); script_name(english:"openSUSE Security Update : ffmpeg (openSUSE-2015-821)"); script_summary(english:"Check for the openSUSE-2015-821 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "The ffmpeg package was updated to version 2.8.2 to fix the following security and non security issues : - CVE-2015-8216: Fixed the ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c which could cause a denial of service (out-of-bounds array access) (bnc#955346). - CVE-2015-8217: Fixed the ff_hevc_parse_sps function in libavcodec/hevc_ps.c which could cause a denial of service (out-of-bounds array access) (bnc#955347). - CVE-2015-8218: Fixed the decode_uncompressed function in libavcodec/faxcompr.c which could cause a denial of service (out-of-bounds array access) (bnc#955348). - CVE-2015-8219: Fixed the init_tile function in libavcodec/jpeg2000dec.c which could cause a denial of service (out-of-bounds array access) (bnc#955350). - Update to new upstream release 2.8.2 - various fixes in the aac_fixed decoder - various fixes in softfloat - swresample/resample: increase precision for compensation - lavf/mov: add support for sidx fragment indexes - avformat/mxfenc: Only store user comment related tags when needed - ffmpeg: Don't try and write sdp info if none of the outputs had an rtp format. - apng: use correct size for output buffer - jvdec: avoid unsigned overflow in comparison - avcodec/jpeg2000dec: Clip all tile coordinates - avcodec/microdvddec: Check for string end in 'P' case - avcodec/dirac_parser: Fix undefined memcpy() use - avformat/xmv: Discard remainder of packet on error - avformat/xmv: factor return check out of if/else - avcodec/mpeg12dec: Do not call show_bits() with invalid bits - avcodec/faxcompr: Add missing runs check in decode_uncompressed() - libavutil/channel_layout: Check strtol*() for failure - avformat/mpegts: Only start probing data streams within probe_packets - avcodec/hevc_ps: Check chroma_format_idc - avcodec/ffv1dec: Check for 0 quant tables - avcodec/mjpegdec: Reinitialize IDCT on BPP changes - avcodec/mjpegdec: Check index in ljpeg_decode_yuv_scan() before using it - avcodec/h264_slice: Disable slice threads if there are multiple access units in a packet - avformat/hls: update cookies on setcookie response - opusdec: Don't run vector_fmul_scalar on zero length arrays - avcodec/opusdec: Fix extra samples read index - avcodec/ffv1: Initialize vlc_state on allocation - avcodec/ffv1dec: update progress in case of broken pointer chains - avcodec/ffv1dec: Clear slice coordinates if they are invalid or slice header decoding fails for other reasons - rtsp: Allow $ as interleaved packet indicator before a complete response header - videodsp: don't overread edges in vfix3 emu_edge. - avformat/mp3dec: improve junk skipping heuristic - concatdec: fix file_start_time calculation regression - avcodec: loongson optimize h264dsp idct and loop filter with mmi - avcodec/jpeg2000dec: Clear properties in jpeg2000_dec_cleanup() too - avformat/hls: add support for EXT-X-MAP - avformat/hls: fix segment selection regression on track changes of live streams - configure: Require libkvazaar < 0.7. - avcodec/vp8: Do not use num_coeff_partitions in thread/buffer setup - Drop ffmpeg-mov-sidx-fragment.patch, fixed upstream. - Update to new upstream release 2.8.1 - Minor bugfix release - Includes all changes from. Ffmpeg-mt, libav master of 2015-08-28, libav 11 as of 2015-08-28 - Add ffmpeg-mov-sidx-fragment.patch to add sidx fragment indexes. Needed for new mpv release." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=955346" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=955347" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=955348" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=955350" ); script_set_attribute( attribute:"solution", value:"Update the affected ffmpeg packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:ffmpeg"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:ffmpeg-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:ffmpeg-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:ffmpeg-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavcodec-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavcodec56"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavcodec56-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavcodec56-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavcodec56-debuginfo-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavdevice-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavdevice56"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavdevice56-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavdevice56-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavdevice56-debuginfo-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavfilter-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavfilter5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavfilter5-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavfilter5-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavfilter5-debuginfo-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavformat-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavformat56"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavformat56-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavformat56-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavformat56-debuginfo-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavresample-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavresample2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavresample2-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavresample2-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavresample2-debuginfo-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavutil-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavutil54"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavutil54-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavutil54-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libavutil54-debuginfo-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpostproc-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpostproc53"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpostproc53-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpostproc53-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpostproc53-debuginfo-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libswresample-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libswresample1"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libswresample1-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libswresample1-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libswresample1-debuginfo-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libswscale-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libswscale3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libswscale3-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libswscale3-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libswscale3-debuginfo-32bit"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.1"); script_set_attribute(attribute:"patch_publication_date", value:"2015/11/27"); script_set_attribute(attribute:"plugin_publication_date", value:"2015/11/30"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2015-2020 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE42\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.1", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE42.1", reference:"ffmpeg-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"ffmpeg-debuginfo-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"ffmpeg-debugsource-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"ffmpeg-devel-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libavcodec-devel-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libavcodec56-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libavcodec56-debuginfo-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libavdevice-devel-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libavdevice56-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libavdevice56-debuginfo-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libavfilter-devel-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libavfilter5-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libavfilter5-debuginfo-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libavformat-devel-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libavformat56-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libavformat56-debuginfo-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libavresample-devel-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libavresample2-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libavresample2-debuginfo-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libavutil-devel-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libavutil54-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libavutil54-debuginfo-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libpostproc-devel-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libpostproc53-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libpostproc53-debuginfo-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libswresample-devel-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libswresample1-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libswresample1-debuginfo-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libswscale-devel-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libswscale3-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libswscale3-debuginfo-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libavcodec56-32bit-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libavcodec56-debuginfo-32bit-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libavdevice56-32bit-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libavdevice56-debuginfo-32bit-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libavfilter5-32bit-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libavfilter5-debuginfo-32bit-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libavformat56-32bit-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libavformat56-debuginfo-32bit-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libavresample2-32bit-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libavresample2-debuginfo-32bit-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libavutil54-32bit-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libavutil54-debuginfo-32bit-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libpostproc53-32bit-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libpostproc53-debuginfo-32bit-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libswresample1-32bit-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libswresample1-debuginfo-32bit-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libswscale3-32bit-2.8.2-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libswscale3-debuginfo-32bit-2.8.2-3.1") ) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ffmpeg / ffmpeg-debuginfo / ffmpeg-debugsource / ffmpeg-devel / etc"); }NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_B0DA85AF21A34C15A137FE9E4BC86002.NASL description NVD reports : The update_dimensions function in libavcodec/vp8.c in FFmpeg through 2.8.1, as used in Google Chrome before 46.0.2490.71 and other products, relies on a coefficient-partition count during multi-threaded operation, which allows remote attackers to cause a denial of service (race condition and memory corruption) or possibly have unspecified other impact via a crafted WebM file. The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain width and height checks, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data. The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indicator, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted High Efficiency Video Coding (HEVC) data. The decode_uncompressed function in libavcodec/faxcompr.c in FFmpeg before 2.8.2 does not validate uncompressed runs, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted CCITT FAX data. The init_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.2 does not enforce minimum-value and maximum-value constraints on tile coordinates, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data. The jpeg2000_read_main_headers function in libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not enforce uniqueness of the SIZ marker in a JPEG 2000 image, which allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via a crafted image with two or more of these markers. Integer overflow in the ff_ivi_init_planes function in libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via crafted image dimensions in Indeo Video Interactive data. The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not verify that the data size is consistent with the number of channels, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data. last seen 2020-03-18 modified 2015-12-03 plugin id 87178 published 2015-12-03 reporter This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/87178 title FreeBSD : ffmpeg -- multiple vulnerabilities (b0da85af-21a3-4c15-a137-fe9e4bc86002) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from the FreeBSD VuXML database : # # Copyright 2003-2020 Jacques Vidrine and contributors # # Redistribution and use in source (VuXML) and 'compiled' forms (SGML, # HTML, PDF, PostScript, RTF and so forth) with or without modification, # are permitted provided that the following conditions are met: # 1. Redistributions of source code (VuXML) must retain the above # copyright notice, this list of conditions and the following # disclaimer as the first lines of this file unmodified. # 2. Redistributions in compiled form (transformed to other DTDs, # published online in any format, converted to PDF, PostScript, # RTF and other formats) must reproduce the above copyright # notice, this list of conditions and the following disclaimer # in the documentation and/or other materials provided with the # distribution. # # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION, # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include("compat.inc"); if (description) { script_id(87178); script_version("2.6"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/24"); script_cve_id("CVE-2015-6761", "CVE-2015-8216", "CVE-2015-8217", "CVE-2015-8218", "CVE-2015-8219", "CVE-2015-8363", "CVE-2015-8364", "CVE-2015-8365"); script_name(english:"FreeBSD : ffmpeg -- multiple vulnerabilities (b0da85af-21a3-4c15-a137-fe9e4bc86002)"); script_summary(english:"Checks for updated packages in pkg_info output"); script_set_attribute( attribute:"synopsis", value: "The remote FreeBSD host is missing one or more security-related updates." ); script_set_attribute( attribute:"description", value: "NVD reports : The update_dimensions function in libavcodec/vp8.c in FFmpeg through 2.8.1, as used in Google Chrome before 46.0.2490.71 and other products, relies on a coefficient-partition count during multi-threaded operation, which allows remote attackers to cause a denial of service (race condition and memory corruption) or possibly have unspecified other impact via a crafted WebM file. The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain width and height checks, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data. The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indicator, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted High Efficiency Video Coding (HEVC) data. The decode_uncompressed function in libavcodec/faxcompr.c in FFmpeg before 2.8.2 does not validate uncompressed runs, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted CCITT FAX data. The init_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.2 does not enforce minimum-value and maximum-value constraints on tile coordinates, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data. The jpeg2000_read_main_headers function in libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not enforce uniqueness of the SIZ marker in a JPEG 2000 image, which allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via a crafted image with two or more of these markers. Integer overflow in the ff_ivi_init_planes function in libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via crafted image dimensions in Indeo Video Interactive data. The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not verify that the data size is consistent with the number of channels, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data." ); # https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=dabea74d0e82ea80cd344f630497cafcb3ef872c script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?df1a1bd8" ); # https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d24888ef19ba38b787b11d1ee091a3d94920c76a script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?863da8c9" ); # https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=93f30f825c08477fe8f76be00539e96014cc83c8 script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?f905b5c0" ); # https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d4a731b84a08f0f3839eaaaf82e97d8d9c67da46 script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?abf9f942" ); # https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=43492ff3ab68a343c1264801baa1d5a02de10167 script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?38aeb8a2" ); # https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=44a7f17d0b20e6f8d836b2957e3e357b639f19a2 script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?83fa2994" ); # https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=df91aa034b82b77a3c4e01791f4a2b2ff6c82066 script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?a9020836" ); # https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=4a9af07a49295e014b059c1ab624c40345af5892 script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?a67cce36" ); script_set_attribute( attribute:"see_also", value:"https://ffmpeg.org/security.html" ); # https://vuxml.freebsd.org/freebsd/b0da85af-21a3-4c15-a137-fe9e4bc86002.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?c18a0e41" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:avidemux"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:avidemux2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:avidemux26"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ffmpeg"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ffmpeg-011"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ffmpeg-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ffmpeg0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ffmpeg1"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ffmpeg2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ffmpeg23"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ffmpeg24"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ffmpeg25"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ffmpeg26"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:gstreamer-ffmpeg"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:handbrake"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:kodi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:libav"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:mencoder"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:mplayer"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:mythtv"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:mythtv-frontend"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:plexhometheater"); script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd"); script_set_attribute(attribute:"vuln_publication_date", value:"2015/11/27"); script_set_attribute(attribute:"patch_publication_date", value:"2015/12/02"); script_set_attribute(attribute:"plugin_publication_date", value:"2015/12/03"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"FreeBSD Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info"); exit(0); } include("audit.inc"); include("freebsd_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD"); if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (pkg_test(save_report:TRUE, pkg:"libav>=0")) flag++; if (pkg_test(save_report:TRUE, pkg:"gstreamer-ffmpeg>=0")) flag++; if (pkg_test(save_report:TRUE, pkg:"handbrake<1.2.0")) flag++; if (pkg_test(save_report:TRUE, pkg:"ffmpeg>=2.8,1<2.8.3,1")) flag++; if (pkg_test(save_report:TRUE, pkg:"ffmpeg<2.7.3,1")) flag++; if (pkg_test(save_report:TRUE, pkg:"ffmpeg26<2.6.5")) flag++; if (pkg_test(save_report:TRUE, pkg:"ffmpeg25<2.5.9")) flag++; if (pkg_test(save_report:TRUE, pkg:"ffmpeg24<2.4.12")) flag++; if (pkg_test(save_report:TRUE, pkg:"ffmpeg-devel>=0")) flag++; if (pkg_test(save_report:TRUE, pkg:"ffmpeg23>=0")) flag++; if (pkg_test(save_report:TRUE, pkg:"ffmpeg2>=0")) flag++; if (pkg_test(save_report:TRUE, pkg:"ffmpeg1>=0")) flag++; if (pkg_test(save_report:TRUE, pkg:"ffmpeg-011>=0")) flag++; if (pkg_test(save_report:TRUE, pkg:"ffmpeg0>=0")) flag++; if (pkg_test(save_report:TRUE, pkg:"avidemux<=2.6.11")) flag++; if (pkg_test(save_report:TRUE, pkg:"avidemux2<=2.6.11")) flag++; if (pkg_test(save_report:TRUE, pkg:"avidemux26<=2.6.11")) flag++; if (pkg_test(save_report:TRUE, pkg:"kodi<16.0")) flag++; if (pkg_test(save_report:TRUE, pkg:"mplayer<1.1.r20150822_7")) flag++; if (pkg_test(save_report:TRUE, pkg:"mencoder<1.1.r20150822_7")) flag++; if (pkg_test(save_report:TRUE, pkg:"mythtv<=0.27.5,1")) flag++; if (pkg_test(save_report:TRUE, pkg:"mythtv-frontend<=0.27.5,1")) flag++; if (pkg_test(save_report:TRUE, pkg:"plexhometheater>=0")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");