Bug 1079368 (CVE-2018-6621) - VUL-0: CVE-2018-6621: ffmpeg: denial of service inside the decode_frame function in libavcodec/utvideodec.c
Summary: VUL-0: CVE-2018-6621: ffmpeg: denial of service inside the decode_frame funct...
Status: RESOLVED FIXED
Alias: CVE-2018-6621
Product: openSUSE Distribution
Classification: openSUSE
Component: Security (show other bugs)
Version: Leap 42.3
Hardware: Other Other
: P3 - Medium : Normal (vote)
Target Milestone: ---
Assignee: Jan Engelhardt
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/199479/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-02-05 14:29 UTC by Alexander Bergmann
Modified: 2024-04-22 17:15 UTC (History)
0 users

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2018-02-05 14:29:17 UTC 
CVE-2018-6621

The decode_frame function in libavcodec/utvideodec.c in FFmpeg through 3.4.1
allows remote attackers to cause a denial of service (out of array read) via a
crafted AVI file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6621
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/118e1b0b3370dd1c0da442901b486689efd1654b
Comment 1 Jan Engelhardt 2018-02-12 12:02:05 UTC 
utvideodec.c is not built in openSUSE.
Comment 2 Swamp Workflow Management 2018-02-12 13:50:30 UTC 
This is an autogenerated message for OBS integration:
This bug (1079368) was mentioned in
https://build.opensuse.org/request/show/575779 42.3 / ffmpeg
Comment 3 Swamp Workflow Management 2018-02-19 14:10:57 UTC 
openSUSE-SU-2018:0470-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1064577,1066428,1069407,1070762,1072366,1078488,1079368
CVE References: CVE-2017-15186,CVE-2017-15672,CVE-2017-16840,CVE-2017-17081,CVE-2017-17555,CVE-2018-6392,CVE-2018-6621
Sources used:
SUSE Package Hub for SUSE Linux Enterprise 12 (src):    ffmpeg-3.4.2-14.1
Comment 4 Swamp Workflow Management 2018-02-19 14:16:29 UTC 
openSUSE-SU-2018:0476-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1064577,1066428,1069407,1070762,1072366,1078488,1079368
CVE References: CVE-2017-15186,CVE-2017-15672,CVE-2017-16840,CVE-2017-17081,CVE-2017-17555,CVE-2018-6392,CVE-2018-6621
Sources used:
openSUSE Leap 42.3 (src):    ffmpeg-3.4.2-10.1
Comment 7 Swamp Workflow Management 2018-07-18 14:42:32 UTC 
This is an autogenerated message for OBS integration:
This bug (1079368) was mentioned in
https://build.opensuse.org/request/show/623663 15.0+42.3+Backports:SLE-12-SP2 / chromium+codec2+ffmpeg-2+ffmpeg-3+ffmpeg-4+libsodium+libvpx-1_6+zeromq
Comment 9 OBSbugzilla Bot 2024-04-22 14:25:30 UTC 
This is an autogenerated message for OBS integration:
This bug (1079368) was mentioned in
https://build.opensuse.org/request/show/1169676 Backports:SLE-15-SP5 / ffmpeg-4
Comment 10 OBSbugzilla Bot 2024-04-22 17:15:31 UTC 
This is an autogenerated message for OBS integration:
This bug (1079368) was mentioned in
https://build.opensuse.org/request/show/1169721 Backports:SLE-15-SP5 / ffmpeg-4