openSUSE-SU-2021:2322-1: important: Security update for ffmpeg
openSUSE Security Update: Security update for ffmpeg
______________________________________________________________________________
Announcement ID: openSUSE-SU-2021:2322-1
Rating: important
References: #1172640 #1186406 #1186583 #1186586 #1186587
#1186596 #1186597 #1186598 #1186600 #1186603
#1186604 #1186605 #1186613 #1186614 #1186615
#1186616 #1186658 #1186660 #1186757 #1186758
#1186762 #1186763
Cross-References: CVE-2019-17539 CVE-2020-13904 CVE-2020-20448
CVE-2020-20451 CVE-2020-21041 CVE-2020-22015
CVE-2020-22016 CVE-2020-22017 CVE-2020-22019
CVE-2020-22020 CVE-2020-22021 CVE-2020-22022
CVE-2020-22023 CVE-2020-22025 CVE-2020-22026
CVE-2020-22031 CVE-2020-22032 CVE-2020-22033
CVE-2020-22034 CVE-2020-22038 CVE-2020-22039
CVE-2020-22043 CVE-2020-22044
CVSS scores:
CVE-2019-17539 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2019-17539 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVE-2020-13904 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-13904 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CVE-2020-20448 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-20451 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2020-20451 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-21041 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2020-22015 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2020-22015 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22016 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2020-22016 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVE-2020-22017 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2020-22017 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22019 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22019 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22020 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22020 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22021 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22021 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22022 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2020-22022 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22023 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2020-22023 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22025 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2020-22025 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22026 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22026 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22031 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2020-22031 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22032 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22033 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22033 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22034 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2020-22034 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22038 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22039 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22043 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2020-22044 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products:
openSUSE Leap 15.3
______________________________________________________________________________
An update that fixes 23 vulnerabilities is now available.
Description:
This update for ffmpeg fixes the following issues:
- CVE-2020-13904: Fixed use-after-free via a crafted EXTINF duration in an
m3u8 file (bsc#1172640).
- CVE-2020-21041: Fixed buffer overflow vulnerability via
apng_do_inverse_blend in libavcodec/pngenc.c (bsc#1186406).
- CVE-2019-17539: Fixed NULL pointer dereference in avcodec_open2 in
libavcodec/utils.c (bsc# 1154065).
- CVE-2020-22026: Fixed buffer overflow vulnerability in config_input() at
libavfilter/af_tremolo.c (bsc#1186583).
- CVE-2020-22021: Fixed buffer overflow vulnerability in filter_edges
function in libavfilter/vf_yadif.c (bsc#1186586).
- CVE-2020-22020: Fixed buffer overflow vulnerability in build_diff_map()
in libavfilter/vf_fieldmatch.c (bsc#1186587).
- CVE-2020-22015: Fixed buffer overflow vulnerability in
mov_write_video_tag() due to the out of bounds in libavformat/movenc.c
(bsc#1186596).
- CVE-2020-22016: Fixed a heap-based Buffer Overflow vulnerability at
libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- CVE-2020-22017: Fixed a heap-based Buffer Overflow vulnerability in
ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- CVE-2020-22022: Fixed a heap-based Buffer Overflow vulnerability in
filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- CVE-2020-22023: Fixed a heap-based Buffer Overflow vulnerability in
filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- CVE-2020-22025: Fixed a heap-based Buffer Overflow vulnerability in
gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- CVE-2020-22031: Fixed a heap-based Buffer Overflow vulnerability at
libavfilter/vf_w3fdif.c in filter16_complex_low() (bsc#1186613).
- CVE-2020-22032: Fixed a heap-based Buffer Overflow vulnerability at
libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- CVE-2020-22034: Fixed a heap-based Buffer Overflow vulnerability at
libavfilter/vf_floodfill.c (bsc#1186616).
- CVE-2020-20451: Fixed denial of service issue due to resource management
errors via fftools/cmdutils.c (bsc#1186658).
- CVE-2020-20448: Fixed divide by zero issue via libavcodec/ratecontrol.c
(bsc#1186660).
- CVE-2020-22038: Fixed denial of service vulnerability due to a memory
leak in the ff_v4l2_m2m_create_context function in v4l2_m2m.c
(bsc#1186757).
- CVE-2020-22039: Fixed denial of service vulnerability due to a memory
leak in the inavi_add_ientry function (bsc#1186758).
- CVE-2020-22043: Fixed denial of service vulnerability due to a memory
leak at the fifo_alloc_common function in libavutil/fifo.c (bsc#1186762).
- CVE-2020-22044: Fixed denial of service vulnerability due to a memory
leak in the url_open_dyn_buf_internal function in libavformat/aviobuf.c
(bsc#1186763).
- CVE-2020-22033,CVE-2020-22019: Fixed a heap-based Buffer Overflow
Vulnerability at libavfilter/vf_vmafmotion.c in convolution_y_8bit() and
in convolution_y_10bit() in libavfilter/vf_vmafmotion.c (bsc#1186615,
bsc#1186597).
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-SLE-15.3-2021-2322=1
Package List:
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
ffmpeg-3.4.2-11.3.1
ffmpeg-debuginfo-3.4.2-11.3.1
ffmpeg-debugsource-3.4.2-11.3.1
ffmpeg-private-devel-3.4.2-11.3.1
libavcodec-devel-3.4.2-11.3.1
libavcodec57-3.4.2-11.3.1
libavcodec57-debuginfo-3.4.2-11.3.1
libavdevice-devel-3.4.2-11.3.1
libavdevice57-3.4.2-11.3.1
libavdevice57-debuginfo-3.4.2-11.3.1
libavfilter-devel-3.4.2-11.3.1
libavfilter6-3.4.2-11.3.1
libavfilter6-debuginfo-3.4.2-11.3.1
libavformat-devel-3.4.2-11.3.1
libavformat57-3.4.2-11.3.1
libavformat57-debuginfo-3.4.2-11.3.1
libavresample-devel-3.4.2-11.3.1
libavresample3-3.4.2-11.3.1
libavresample3-debuginfo-3.4.2-11.3.1
libavutil-devel-3.4.2-11.3.1
libavutil55-3.4.2-11.3.1
libavutil55-debuginfo-3.4.2-11.3.1
libpostproc-devel-3.4.2-11.3.1
libpostproc54-3.4.2-11.3.1
libpostproc54-debuginfo-3.4.2-11.3.1
libswresample-devel-3.4.2-11.3.1
libswresample2-3.4.2-11.3.1
libswresample2-debuginfo-3.4.2-11.3.1
libswscale-devel-3.4.2-11.3.1
libswscale4-3.4.2-11.3.1
libswscale4-debuginfo-3.4.2-11.3.1
- openSUSE Leap 15.3 (x86_64):
libavcodec57-32bit-3.4.2-11.3.1
libavcodec57-32bit-debuginfo-3.4.2-11.3.1
libavdevice57-32bit-3.4.2-11.3.1
libavdevice57-32bit-debuginfo-3.4.2-11.3.1
libavfilter6-32bit-3.4.2-11.3.1
libavfilter6-32bit-debuginfo-3.4.2-11.3.1
libavformat57-32bit-3.4.2-11.3.1
libavformat57-32bit-debuginfo-3.4.2-11.3.1
libavresample3-32bit-3.4.2-11.3.1
libavresample3-32bit-debuginfo-3.4.2-11.3.1
libavutil55-32bit-3.4.2-11.3.1
libavutil55-32bit-debuginfo-3.4.2-11.3.1
libpostproc54-32bit-3.4.2-11.3.1
libpostproc54-32bit-debuginfo-3.4.2-11.3.1
libswresample2-32bit-3.4.2-11.3.1
libswresample2-32bit-debuginfo-3.4.2-11.3.1
libswscale4-32bit-3.4.2-11.3.1
libswscale4-32bit-debuginfo-3.4.2-11.3.1
References:
https://www.suse.com/security/cve/CVE-2019-17539.html
https://www.suse.com/security/cve/CVE-2020-13904.html
https://www.suse.com/security/cve/CVE-2020-20448.html
https://www.suse.com/security/cve/CVE-2020-20451.html
https://www.suse.com/security/cve/CVE-2020-21041.html
https://www.suse.com/security/cve/CVE-2020-22015.html
https://www.suse.com/security/cve/CVE-2020-22016.html
https://www.suse.com/security/cve/CVE-2020-22017.html
https://www.suse.com/security/cve/CVE-2020-22019.html
https://www.suse.com/security/cve/CVE-2020-22020.html
https://www.suse.com/security/cve/CVE-2020-22021.html
https://www.suse.com/security/cve/CVE-2020-22022.html
https://www.suse.com/security/cve/CVE-2020-22023.html
https://www.suse.com/security/cve/CVE-2020-22025.html
https://www.suse.com/security/cve/CVE-2020-22026.html
https://www.suse.com/security/cve/CVE-2020-22031.html
https://www.suse.com/security/cve/CVE-2020-22032.html
https://www.suse.com/security/cve/CVE-2020-22033.html
https://www.suse.com/security/cve/CVE-2020-22034.html
https://www.suse.com/security/cve/CVE-2020-22038.html
https://www.suse.com/security/cve/CVE-2020-22039.html
https://www.suse.com/security/cve/CVE-2020-22043.html
https://www.suse.com/security/cve/CVE-2020-22044.html
https://bugzilla.suse.com/1172640
https://bugzilla.suse.com/1186406
https://bugzilla.suse.com/1186583
https://bugzilla.suse.com/1186586
https://bugzilla.suse.com/1186587
https://bugzilla.suse.com/1186596
https://bugzilla.suse.com/1186597
https://bugzilla.suse.com/1186598
https://bugzilla.suse.com/1186600
https://bugzilla.suse.com/1186603
https://bugzilla.suse.com/1186604
https://bugzilla.suse.com/1186605
https://bugzilla.suse.com/1186613
https://bugzilla.suse.com/1186614
https://bugzilla.suse.com/1186615
https://bugzilla.suse.com/1186616
https://bugzilla.suse.com/1186658
https://bugzilla.suse.com/1186660
https://bugzilla.suse.com/1186757
https://bugzilla.suse.com/1186758
https://bugzilla.suse.com/1186762
https://bugzilla.suse.com/1186763
A ffmpeg security update has been released for openSUSE Leap 15.3.
