Bugzilla – Bug 1154064
VUL-0: CVE-2019-17542: ffmpeg: heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c.
Last modified: 2020-07-07 16:13:20 UTC
CVE-2019-17542 FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c. References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15919 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-17542 http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-17542.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17542 https://github.com/FFmpeg/FFmpeg/commit/02f909dc24b1f05cfbba75077c7707b905e63cd2
tracking as affected: - SUSE:SLE-15:Update
For the request has been accepted, Maybe it can be forward to our security team now. if there has any problem, please ping me. Thanks!
SUSE-SU-2019:3184-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1100352,1129715,1137526,1154064 CVE References: CVE-2018-13301,CVE-2019-12730,CVE-2019-17542,CVE-2019-9718 Sources used: SUSE Linux Enterprise Workstation Extension 15-SP1 (src): ffmpeg-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 (src): ffmpeg-3.4.2-4.27.1 SUSE Linux Enterprise Module for Packagehub Subpackages 15 (src): ffmpeg-3.4.2-4.27.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): ffmpeg-3.4.2-4.27.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): ffmpeg-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15-SP1 (src): ffmpeg-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 (src): ffmpeg-3.4.2-4.27.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Done
SUSE-SU-2019:3184-2: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1100352,1129715,1137526,1154064 CVE References: CVE-2018-13301,CVE-2019-12730,CVE-2019-17542,CVE-2019-9718 Sources used: SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP1 (src): ffmpeg-3.4.2-4.27.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.