Bug 1100352 (CVE-2018-13301)

Summary: VUL-1: CVE-2018-13301: ffmpeg: missing check of a profile value before setting it, the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c may trigger a NULL pointer dereference
Product: [Novell Products] SUSE Security Incidents Reporter: Johannes Segitz <jsegitz>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Minor    
Priority: P4 - Low CC: abergmann, atoptsoglou, qzhao, smash_bz, sreeves, yfjiang
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/209616/
Whiteboard: CVSSv3:SUSE:CVE-2018-13301:3.3:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) CVSSv2:NVD:CVE-2018-13301:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv3:NVD:CVE-2018-13301:6.5:(AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Johannes Segitz 2018-07-06 06:39:43 UTC
CVE-2018-13301

In FFmpeg 4.0.1, due to a missing check of a profile value before setting it,
the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c may
trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4,
leading to a denial of service.

SLE 15 affected

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13301
https://github.com/FFmpeg/FFmpeg/commit/2aa9047486dbff12d9e040f917e5f799ed2fd78b
Comment 1 Scott Reeves 2018-08-17 22:13:30 UTC
Hi Yifan, can you have your team take this. Thanks.
Comment 3 Qiang Zheng 2018-08-29 08:37:19 UTC
The fix is already in multimedia:libs/ffmpeg-4.
Comment 12 Cliff Zhao 2019-08-14 07:33:20 UTC
Hi:
The patch has been accepted, so I will hand it back to the security team. Thanks for reporting!
Comment 14 Swamp Workflow Management 2019-12-05 14:11:17 UTC
SUSE-SU-2019:3184-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1100352,1129715,1137526,1154064
CVE References: CVE-2018-13301,CVE-2019-12730,CVE-2019-17542,CVE-2019-9718
Sources used:
SUSE Linux Enterprise Workstation Extension 15-SP1 (src):    ffmpeg-3.4.2-4.27.1
SUSE Linux Enterprise Workstation Extension 15 (src):    ffmpeg-3.4.2-4.27.1
SUSE Linux Enterprise Module for Packagehub Subpackages 15 (src):    ffmpeg-3.4.2-4.27.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src):    ffmpeg-3.4.2-4.27.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src):    ffmpeg-3.4.2-4.27.1
SUSE Linux Enterprise Module for Desktop Applications 15-SP1 (src):    ffmpeg-3.4.2-4.27.1
SUSE Linux Enterprise Module for Desktop Applications 15 (src):    ffmpeg-3.4.2-4.27.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 15 Swamp Workflow Management 2020-07-07 16:13:01 UTC
SUSE-SU-2019:3184-2: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1100352,1129715,1137526,1154064
CVE References: CVE-2018-13301,CVE-2019-12730,CVE-2019-17542,CVE-2019-9718
Sources used:
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP1 (src):    ffmpeg-3.4.2-4.27.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 16 Alexandros Toptsoglou 2020-07-13 14:53:24 UTC
Done