MGASA-2015-0233

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2015-0233.html
Import Source
https://advisories.mageia.org/MGASA-2015-0233.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2015-0233
Upstream
Published
2015-05-18T19:08:05Z
Modified
2026-04-16T06:25:41Z
Summary
Updated avidemux packages fix security vulnerabilities
Details

Updated avidemux packages fix security vulnerabilities:

The mjpeg_decode_app function in libavcodec/mjpegdec.c in FFMpeg before 1.2.11 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via vectors related to LJIF tags in an MJPEG file (CVE-2014-9316).

The decode_ihdr_chunk function in libavcodec/pngdec.c in FFMpeg before 1.2.11 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via an IDAT before an IHDR in a PNG file (CVE-2014-9317).

The vmd_decode function in libavcodec/vmdvideo.c in FFmpeg before 1.2.11 does not validate the relationship between a certain length value and the frame width, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Sierra VMD video data (CVE-2014-9603).

libavcodec/utvideodec.c in FFmpeg before 1.2.11 does not check for a zero value of a slice height, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Ut Video data, related to the restore_median and restore_median_il functions (CVE-2014-9604).

An attacker can force a read at an invalid address in mjpegdec.c of FFmpeg, in order to trigger a denial of service (CVE-2015-1872).

Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 1.2.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references H.264 data (CVE-2015-3417).

Avidemux is built with a bundled set of FFmpeg libraries. The bundled FFmpeg version has been updated from 1.2.10 to 1.2.12 to fix these security issues and other bugs fixed upstream in FFmpeg.

References
Credits

Affected packages

Mageia:4 / avidemux

Package

Name
avidemux
Purl
pkg:rpm/mageia/avidemux?arch=source&distro=mageia-4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.6.6-2.3.mga4

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2015-0233.json"

Mageia:4 / avidemux

Package

Name
avidemux
Purl
pkg:rpm/mageia/avidemux?arch=source&distro=mageia-4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.6.6-2.3.mga4.tainted

Ecosystem specific 

{
    "section": "tainted"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2015-0233.json"