[CVE-2010-4705] [CVE-2010-4704] integer overflow in Vorbis decoder

Debian Bug report logs - #611495
[CVE-2010-4705] [CVE-2010-4704] integer overflow in Vorbis decoder

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Luciano Bello <luciano@debian.org>

To: submit@bugs.debian.org

Subject: [CVE-2010-4705] [CVE-2010-4704] integer overflow in Vorbis decoder

Date: Sat, 29 Jan 2011 19:57:24 -0300

Package: ffmpeg
Severity: important
Tags: security patch

Hi,
the following CVE (Common Vulnerabilities & Exposures) ids were
published for ffmpeg. Patches are provided in the CVE notes.

CVE-2010-4704[0]:
| libavcodec/vorbis_dec.c in the Vorbis decoder in FFmpeg 0.6.1 and
| earlier allows remote attackers to cause a denial of service
| (application crash) via a crafted .ogg file, related to the
| vorbis_floor0_decode function.  NOTE: this might overlap CVE-2011-0480.

CVE-2010-4705[1]:
| Integer overflow in the vorbis_residue_decode_internal function in
| libavcodec/vorbis_dec.c in the Vorbis decoder in FFmpeg, possibly 0.6,
| has unspecified impact and remote attack vectors, related to the sizes
| of certain integer data types.  NOTE: this might overlap CVE-2011-0480.

If you fix the vulnerabilities please also make sure to include the
CVE ids in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4704
    http://security-tracker.debian.org/tracker/CVE-2010-4704
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4705
    http://security-tracker.debian.org/tracker/CVE-2010-4705

PoC available: http://roundup.ffmpeg.org/issue2322

l.

Message #10 received at 611495@bugs.debian.org (full text, mbox, reply):

From: Michael Gilbert <michael.s.gilbert@gmail.com>

To: 611495@bugs.debian.org

Subject: some info

Date: Mon, 31 Jan 2011 23:59:05 -0500

the second issue doesn't affect 0.5.2 since classifs isn't a pointer
in that version.  the first issue is a fuzzing crash, so i don't know
if it should be considered that important since its not clearly
exploitable.  it does however affect 0.5.2.

best wishes,
mike

Message #21 received at 611495-close@bugs.debian.org (full text, mbox, reply):

From: Reinhard Tartler <siretart@tauware.de>

To: 611495-close@bugs.debian.org

Subject: Bug#611495: fixed in libav 4:0.6.2-1

Date: Tue, 29 Mar 2011 15:47:38 +0000

Source: libav
Source-Version: 4:0.6.2-1

We believe that the bug you reported is fixed in the latest version of
libav, which is due to be installed in the Debian FTP archive:

ffmpeg-dbg_0.6.2-1_i386.deb
  to main/liba/libav/ffmpeg-dbg_0.6.2-1_i386.deb
ffmpeg-doc_0.6.2-1_all.deb
  to main/liba/libav/ffmpeg-doc_0.6.2-1_all.deb
ffmpeg_0.6.2-1_i386.deb
  to main/liba/libav/ffmpeg_0.6.2-1_i386.deb
libav-dbg_0.6.2-1_i386.deb
  to main/liba/libav/libav-dbg_0.6.2-1_i386.deb
libav-doc_0.6.2-1_all.deb
  to main/liba/libav/libav-doc_0.6.2-1_all.deb
libav-source_0.6.2-1_all.deb
  to main/liba/libav/libav-source_0.6.2-1_all.deb
libav_0.6.2-1.diff.gz
  to main/liba/libav/libav_0.6.2-1.diff.gz
libav_0.6.2-1.dsc
  to main/liba/libav/libav_0.6.2-1.dsc
libav_0.6.2.orig.tar.gz
  to main/liba/libav/libav_0.6.2.orig.tar.gz
libavcodec-dev_0.6.2-1_i386.deb
  to main/liba/libav/libavcodec-dev_0.6.2-1_i386.deb
libavcodec52_0.6.2-1_i386.deb
  to main/liba/libav/libavcodec52_0.6.2-1_i386.deb
libavdevice-dev_0.6.2-1_i386.deb
  to main/liba/libav/libavdevice-dev_0.6.2-1_i386.deb
libavdevice52_0.6.2-1_i386.deb
  to main/liba/libav/libavdevice52_0.6.2-1_i386.deb
libavfilter-dev_0.6.2-1_i386.deb
  to main/liba/libav/libavfilter-dev_0.6.2-1_i386.deb
libavfilter1_0.6.2-1_i386.deb
  to main/liba/libav/libavfilter1_0.6.2-1_i386.deb
libavformat-dev_0.6.2-1_i386.deb
  to main/liba/libav/libavformat-dev_0.6.2-1_i386.deb
libavformat52_0.6.2-1_i386.deb
  to main/liba/libav/libavformat52_0.6.2-1_i386.deb
libavutil-dev_0.6.2-1_i386.deb
  to main/liba/libav/libavutil-dev_0.6.2-1_i386.deb
libavutil50_0.6.2-1_i386.deb
  to main/liba/libav/libavutil50_0.6.2-1_i386.deb
libpostproc-dev_0.6.2-1_i386.deb
  to main/liba/libav/libpostproc-dev_0.6.2-1_i386.deb
libpostproc51_0.6.2-1_i386.deb
  to main/liba/libav/libpostproc51_0.6.2-1_i386.deb
libswscale-dev_0.6.2-1_i386.deb
  to main/liba/libav/libswscale-dev_0.6.2-1_i386.deb
libswscale0_0.6.2-1_i386.deb
  to main/liba/libav/libswscale0_0.6.2-1_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 611495@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Reinhard Tartler <siretart@tauware.de> (supplier of updated libav package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sat, 19 Mar 2011 08:13:46 +0100
Source: libav
Binary: ffmpeg ffmpeg-dbg libav-dbg libav-source ffmpeg-doc libav-doc libavutil50 libavcodec52 libavdevice52 libavformat52 libavfilter1 libpostproc51 libswscale0 libavutil-dev libavcodec-dev libavdevice-dev libavformat-dev libavfilter-dev libpostproc-dev libswscale-dev
Architecture: source i386 all
Version: 4:0.6.2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian multimedia packages maintainers <pkg-multimedia-maintainers@lists.alioth.debian.org>
Changed-By: Reinhard Tartler <siretart@tauware.de>
Description: 
 ffmpeg     - Multimedia player, server, encoder and transcoder
 ffmpeg-dbg - Debug symbols for Libav related packages
 ffmpeg-doc - Documentation of the Libav API (transitional package)
 libav-dbg  - Debug symbols for Libav related packages
 libav-doc  - Documentation of the Libav API
 libav-source - Patched Libav sources
 libavcodec-dev - Development files for libavcodec
 libavcodec52 - Libav codec library
 libavdevice-dev - Development files for libavdevice
 libavdevice52 - Libav device handling library
 libavfilter-dev - Development files for libavfilter
 libavfilter1 - Libav video filtering library
 libavformat-dev - Development files for libavformat
 libavformat52 - Libav file format library
 libavutil-dev - Development files for libavutil
 libavutil50 - Libav utility library
 libpostproc-dev - Development files for libpostproc
 libpostproc51 - Libav video postprocessing library
 libswscale-dev - Development files for libswscale
 libswscale0 - Libav video scaling library
Closes: 611495 616190 618679
Changes: 
 libav (4:0.6.2-1) unstable; urgency=medium
 .
   [ Reinhard Tartler ]
   * Imported Upstream version 0.6.2
     - include security fixes (Closes: #611495)
   * rename source package to libav
   * Switch to libav packages
   * copy in changelog entries from the 0.5 packaging branch (Closes: #616190)
   * update version numbering
   * make buildlogs verbose
   * Introduce 'libav-source', which contains the patched sources of libav
   * rename source package to libav
 .
   [ Fabian Greffrath ]
   * Fix cp of doxy documentation fails with "Argument list too long" (Closes: #618679)
Checksums-Sha1: 
 9d5b34049e3b87952e4058729cf1369ce9dfd1f3 2324 libav_0.6.2-1.dsc
 d44447a23474d24f15d982d2352f35f134f7f6c5 4404885 libav_0.6.2.orig.tar.gz
 e14a73c5634df488a708a132f9546cbf7133dee2 32763 libav_0.6.2-1.diff.gz
 ca2aa754cbb8aff3ca2d782a5bff33dcbaf9c2a6 273070 ffmpeg_0.6.2-1_i386.deb
 0f393680d4e4dfb87765e59ee2d3bf68e1538374 39412 ffmpeg-dbg_0.6.2-1_i386.deb
 ada9110f887c130745bd3a80231a169840cea56e 15355590 libav-dbg_0.6.2-1_i386.deb
 781405a399ef9dcf1de376eddf5e431b4a0c3baf 25507642 libav-source_0.6.2-1_all.deb
 2119c2c910036d212260b211a0fbb26b87010442 39342 ffmpeg-doc_0.6.2-1_all.deb
 14deec5781df9461a15be4a5d559900c1c65818b 17486758 libav-doc_0.6.2-1_all.deb
 b019de715d0ec4090c5126bee73bf5027e9c96ec 105866 libavutil50_0.6.2-1_i386.deb
 33ab291a1c640452fdbaf04a55971d12a81fc0b0 4515732 libavcodec52_0.6.2-1_i386.deb
 45f272e0e897aaf2b5c35cf7ef61c61b87882167 75898 libavdevice52_0.6.2-1_i386.deb
 31650250433b09c21fadfe165c4210f4b561d5b4 839126 libavformat52_0.6.2-1_i386.deb
 447dc5ded9148566dbd9e87afa50520c0450fbdc 79186 libavfilter1_0.6.2-1_i386.deb
 edf7c69911ebf16efa67eef5fb5f99b837224005 156652 libpostproc51_0.6.2-1_i386.deb
 1e4393d5881d7597bab1519f03339e709696911f 236894 libswscale0_0.6.2-1_i386.deb
 b6b7b6b273e84fa9f1da8100f3d8776b985d80e6 90844 libavutil-dev_0.6.2-1_i386.deb
 f1bd23aed625ec611de4b3fbddd3287cbcba1f3f 2556800 libavcodec-dev_0.6.2-1_i386.deb
 be39698be8eea79c1f49919341a2f302a851de1a 58810 libavdevice-dev_0.6.2-1_i386.deb
 2e3e2dec793fccbfac687ecb473b4ab003efa6d1 531346 libavformat-dev_0.6.2-1_i386.deb
 8396384f9f1ce5565bbbb1c6144994eb3765f978 69834 libavfilter-dev_0.6.2-1_i386.deb
 8067dfb1f1e722923dc1af8d695ed61351244363 100164 libpostproc-dev_0.6.2-1_i386.deb
 1d0fa6d4ad96a7395c87e28f76004bc0040f2e2a 150668 libswscale-dev_0.6.2-1_i386.deb
Checksums-Sha256: 
 0ed12bda788034c26d8629883efb075efe7959b613396ec306652a8a2436c2b8 2324 libav_0.6.2-1.dsc
 2b8333d16e28b9a160aba5ea64f87685408a38f36219c3fff5570ea72390c363 4404885 libav_0.6.2.orig.tar.gz
 fae52403c759454a6c4da7cd40ac66a5e6702773c79790e2a5d6da64304fcdeb 32763 libav_0.6.2-1.diff.gz
 c02dd88332b2da021ee19002277df849136b9cdcb37ecd3c714287a964c3733f 273070 ffmpeg_0.6.2-1_i386.deb
 a001fb2604dfc35dc7e0b5329ce64079681f5a77dfe5916b5123fb9d69b7befc 39412 ffmpeg-dbg_0.6.2-1_i386.deb
 f9534d580096070372f3590e8b066de3fa30c041cd375281b18c68cc08820e1e 15355590 libav-dbg_0.6.2-1_i386.deb
 7cdbc20b60e8ffc4fb096b394e05649822916ef0478bf91fb0bb5f53b899bb68 25507642 libav-source_0.6.2-1_all.deb
 066bdae641983d707a21a447e55a1d8f3a0d75355d2bd87e57111e1d487337e0 39342 ffmpeg-doc_0.6.2-1_all.deb
 2656b840499f4d996657f472599aec89e944deb5686f900f5d09fb67159a5f15 17486758 libav-doc_0.6.2-1_all.deb
 1d8817a5b94c3265a2a3a2bf38fd2bbe86c6dbe2b7f16a4c7ba5828a41555c80 105866 libavutil50_0.6.2-1_i386.deb
 2908594c9793fb58df6ad68c18f37aa011e1dc72ef106124dd0e56881df17606 4515732 libavcodec52_0.6.2-1_i386.deb
 54e7d2db93b167632d29c98bdb4499579933f7e8d92d15384cefcc41ff48cbc3 75898 libavdevice52_0.6.2-1_i386.deb
 651d36d7e4ddbdfedd8b46cae0a4166aedd8e1fd6dc6e1af8151ba5da3fa9b9e 839126 libavformat52_0.6.2-1_i386.deb
 17a9a27b1c3e4eb1a4d73456d6f24d4b93601422ad3f9b317ab28eb3cec653e7 79186 libavfilter1_0.6.2-1_i386.deb
 c7c450e3fac845b8a222e86efc4a397251c5bc39ce673282a069363379a41faf 156652 libpostproc51_0.6.2-1_i386.deb
 f273059133bcbe7f3a0bb8983a495ce1f57fc6df6cb1fff8db719ec3f823b6c3 236894 libswscale0_0.6.2-1_i386.deb
 808da80d2d3f189e4b401769ee0b7456dab84dd89d407dba65b9995608d24b47 90844 libavutil-dev_0.6.2-1_i386.deb
 6f2be79160e9197f07687b0c6216b0b3f15a5ae06490ef87c8bd4fb1960b8dbd 2556800 libavcodec-dev_0.6.2-1_i386.deb
 9c1c1323f8bee345ae61449df882f991e45625ce0ad245b3e39924a5b77490f8 58810 libavdevice-dev_0.6.2-1_i386.deb
 a82077e5b79fb09e28d5184730e66223a1b2c6c75bb45dea64b31ec09d4e1aee 531346 libavformat-dev_0.6.2-1_i386.deb
 cf90a8960374be7b9e5bfe7a1c4f3d5e696ddc36656100b6619586899827e0e4 69834 libavfilter-dev_0.6.2-1_i386.deb
 c29cd7f0d80a15438741049d89622a5156cdbd43e87f19dd318a85374629f9c1 100164 libpostproc-dev_0.6.2-1_i386.deb
 6b8f7116759a550c709c349869ca0639ff877cd181980ade1a049b35ac921211 150668 libswscale-dev_0.6.2-1_i386.deb
Files: 
 5be0c04bfb8cc7ad63e8c103e1d0f3a4 2324 libs optional libav_0.6.2-1.dsc
 f35d3a36d59d246635c2e8268c627c08 4404885 libs optional libav_0.6.2.orig.tar.gz
 56069af06c4248c1369cbcda6dd13e00 32763 libs optional libav_0.6.2-1.diff.gz
 e48fb454dd25ed95f7bc30ce7a2c02ee 273070 video optional ffmpeg_0.6.2-1_i386.deb
 23ce8bf67b83f193e4b23893de56fcc4 39412 debug extra ffmpeg-dbg_0.6.2-1_i386.deb
 8de3fc3579f31d6e1dae6576d45add74 15355590 debug extra libav-dbg_0.6.2-1_i386.deb
 2f4971dc4b21222ed9cdcff2312ae2c2 25507642 devel optional libav-source_0.6.2-1_all.deb
 b11c0571d105d553cf88d678d12d136e 39342 doc optional ffmpeg-doc_0.6.2-1_all.deb
 671c44b52a0a341c9a68c3aa6d5f5093 17486758 doc optional libav-doc_0.6.2-1_all.deb
 4331d0c9cb21a53c29fbf33297f4cd24 105866 libs optional libavutil50_0.6.2-1_i386.deb
 c1ccd5db81eea981826e150ee44dc1fa 4515732 libs optional libavcodec52_0.6.2-1_i386.deb
 f475cca0e7fcfc39a3ff5245e11f1e72 75898 libs optional libavdevice52_0.6.2-1_i386.deb
 8420b731d408273f288038be57665aea 839126 libs optional libavformat52_0.6.2-1_i386.deb
 a7685d7112af9ff6a4ba2fa0a6db9cf6 79186 libs optional libavfilter1_0.6.2-1_i386.deb
 ec799c121064af00247b5f0b9fbf9b8f 156652 libs optional libpostproc51_0.6.2-1_i386.deb
 620db67d3c096c9d66bdf5ba6816825a 236894 libs optional libswscale0_0.6.2-1_i386.deb
 0074795ddb7deb6f13859e48dc225e67 90844 libdevel optional libavutil-dev_0.6.2-1_i386.deb
 c9cd55afbf70d55025f2059eaadfda51 2556800 libdevel optional libavcodec-dev_0.6.2-1_i386.deb
 07b3d071cf0875e8c1ea3e37c694e1ad 58810 libdevel optional libavdevice-dev_0.6.2-1_i386.deb
 9e1fff945fc24623a2fe05cd373dd0ce 531346 libdevel optional libavformat-dev_0.6.2-1_i386.deb
 b91f1fc4a69f36f9d861a9c6fabb98db 69834 libdevel optional libavfilter-dev_0.6.2-1_i386.deb
 762acab0c3260a9b4944209e1b941c64 100164 libdevel optional libpostproc-dev_0.6.2-1_i386.deb
 dc4ca5236f20c74d257540179fb444f3 150668 libdevel optional libswscale-dev_0.6.2-1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Debian Powered!

iEYEARECAAYFAk2EiowACgkQmAg1RJRTSKQ+FwCaA8ovKzz3T6AmXMAaC3x6c5gg
PtsAmwd2D1b1aS7/nd8DKqTeaXa9KKcA
=gpyg
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.