Security update for ffmpeg SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:3184-1 Final 1 1 2019-12-05T10:44:14Z current 2019-12-05T10:44:14Z 2019-12-05T10:44:14Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ffmpeg This update for ffmpeg fixes the following issues: Security issues fixed: - CVE-2019-17542: Fixed a heap-buffer overflow in vqa_decode_chunk due to an out-of-array access (bsc#1154064). - CVE-2019-12730: Fixed an uninitialized use of variables due to an improper check (bsc#1137526). - CVE-2019-9718: Fixed a denial of service in the subtitle decode (bsc#1129715). - CVE-2018-13301: Fixed a denial of service while converting a crafted AVI file to MPEG4 (bsc#1100352). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-3184,SUSE-SLE-Module-Desktop-Applications-15-2019-3184,SUSE-SLE-Module-Desktop-Applications-15-SP1-2019-3184,SUSE-SLE-Module-Development-Tools-OBS-15-2019-3184,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-3184,SUSE-SLE-Module-Packagehub-Subpackages-15-2019-3184,SUSE-SLE-Product-WE-15-2019-3184,SUSE-SLE-Product-WE-15-SP1-2019-3184 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20193184-1/ Link for SUSE-SU-2019:3184-1 https://lists.suse.com/pipermail/sle-security-updates/2019-December/006207.html E-Mail link for SUSE-SU-2019:3184-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1100352 SUSE Bug 1100352 https://bugzilla.suse.com/1129715 SUSE Bug 1129715 https://bugzilla.suse.com/1137526 SUSE Bug 1137526 https://bugzilla.suse.com/1154064 SUSE Bug 1154064 https://www.suse.com/security/cve/CVE-2018-13301/ SUSE CVE CVE-2018-13301 page https://www.suse.com/security/cve/CVE-2019-12730/ SUSE CVE CVE-2019-12730 page https://www.suse.com/security/cve/CVE-2019-17542/ SUSE CVE CVE-2019-17542 page https://www.suse.com/security/cve/CVE-2019-9718/ SUSE CVE CVE-2019-9718 page SUSE Linux Enterprise Module for Desktop Applications 15 SUSE Linux Enterprise Module for Desktop Applications 15 SP1 SUSE Linux Enterprise Module for Package Hub 15 SUSE Linux Enterprise Workstation Extension 15 SUSE Linux Enterprise Workstation Extension 15 SP1 ffmpeg-3.4.2-4.27.1 ffmpeg-private-devel-3.4.2-4.27.1 libavcodec-devel-3.4.2-4.27.1 libavcodec57-3.4.2-4.27.1 libavcodec57-32bit-3.4.2-4.27.1 libavcodec57-64bit-3.4.2-4.27.1 libavdevice-devel-3.4.2-4.27.1 libavdevice57-3.4.2-4.27.1 libavdevice57-32bit-3.4.2-4.27.1 libavdevice57-64bit-3.4.2-4.27.1 libavfilter-devel-3.4.2-4.27.1 libavfilter6-3.4.2-4.27.1 libavfilter6-32bit-3.4.2-4.27.1 libavfilter6-64bit-3.4.2-4.27.1 libavformat-devel-3.4.2-4.27.1 libavformat57-3.4.2-4.27.1 libavformat57-32bit-3.4.2-4.27.1 libavformat57-64bit-3.4.2-4.27.1 libavresample-devel-3.4.2-4.27.1 libavresample3-3.4.2-4.27.1 libavresample3-32bit-3.4.2-4.27.1 libavresample3-64bit-3.4.2-4.27.1 libavutil-devel-3.4.2-4.27.1 libavutil55-3.4.2-4.27.1 libavutil55-32bit-3.4.2-4.27.1 libavutil55-64bit-3.4.2-4.27.1 libpostproc-devel-3.4.2-4.27.1 libpostproc54-3.4.2-4.27.1 libpostproc54-32bit-3.4.2-4.27.1 libpostproc54-64bit-3.4.2-4.27.1 libswresample-devel-3.4.2-4.27.1 libswresample2-3.4.2-4.27.1 libswresample2-32bit-3.4.2-4.27.1 libswresample2-64bit-3.4.2-4.27.1 libswscale-devel-3.4.2-4.27.1 libswscale4-3.4.2-4.27.1 libswscale4-32bit-3.4.2-4.27.1 libswscale4-64bit-3.4.2-4.27.1 libavcodec57-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 libavutil-devel-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 libavutil55-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 libpostproc-devel-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 libpostproc54-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 libswresample-devel-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 libswresample2-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 libswscale-devel-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 libswscale4-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 libavcodec57-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 libavutil-devel-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 libavutil55-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 libpostproc-devel-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 libpostproc54-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 libswresample-devel-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 libswresample2-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 libswscale-devel-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 libswscale4-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 ffmpeg-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 libavdevice57-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 libavfilter6-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 libavcodec-devel-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Workstation Extension 15 libavformat-devel-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Workstation Extension 15 libavformat57-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Workstation Extension 15 libavresample-devel-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Workstation Extension 15 libavresample3-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Workstation Extension 15 libavcodec-devel-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP1 libavformat-devel-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP1 libavformat57-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP1 libavresample-devel-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP1 libavresample3-3.4.2-4.27.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP1 In FFmpeg 4.0.1, due to a missing check of a profile value before setting it, the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service. CVE-2018-13301 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libavcodec57-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libavutil-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libavutil55-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libpostproc-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libpostproc54-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libswresample-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libswresample2-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libswscale-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libswscale4-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libavcodec57-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libavutil-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libavutil55-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libpostproc-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libpostproc54-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libswresample-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libswresample2-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libswscale-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libswscale4-3.4.2-4.27.1 SUSE Linux Enterprise Module for Package Hub 15:ffmpeg-3.4.2-4.27.1 SUSE Linux Enterprise Module for Package Hub 15:libavdevice57-3.4.2-4.27.1 SUSE Linux Enterprise Module for Package Hub 15:libavfilter6-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavcodec-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavformat-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavformat57-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavresample-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavresample3-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavcodec-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavformat-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavformat57-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavresample-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavresample3-3.4.2-4.27.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193184-1/ https://www.suse.com/security/cve/CVE-2018-13301.html CVE-2018-13301 https://bugzilla.suse.com/1100352 SUSE Bug 1100352 aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables. CVE-2019-12730 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libavcodec57-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libavutil-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libavutil55-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libpostproc-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libpostproc54-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libswresample-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libswresample2-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libswscale-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libswscale4-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libavcodec57-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libavutil-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libavutil55-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libpostproc-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libpostproc54-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libswresample-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libswresample2-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libswscale-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libswscale4-3.4.2-4.27.1 SUSE Linux Enterprise Module for Package Hub 15:ffmpeg-3.4.2-4.27.1 SUSE Linux Enterprise Module for Package Hub 15:libavdevice57-3.4.2-4.27.1 SUSE Linux Enterprise Module for Package Hub 15:libavfilter6-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavcodec-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavformat-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavformat57-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavresample-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavresample3-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavcodec-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavformat-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavformat57-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavresample-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavresample3-3.4.2-4.27.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193184-1/ https://www.suse.com/security/cve/CVE-2019-12730.html CVE-2019-12730 https://bugzilla.suse.com/1137526 SUSE Bug 1137526 FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c. CVE-2019-17542 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libavcodec57-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libavutil-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libavutil55-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libpostproc-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libpostproc54-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libswresample-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libswresample2-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libswscale-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libswscale4-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libavcodec57-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libavutil-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libavutil55-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libpostproc-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libpostproc54-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libswresample-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libswresample2-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libswscale-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libswscale4-3.4.2-4.27.1 SUSE Linux Enterprise Module for Package Hub 15:ffmpeg-3.4.2-4.27.1 SUSE Linux Enterprise Module for Package Hub 15:libavdevice57-3.4.2-4.27.1 SUSE Linux Enterprise Module for Package Hub 15:libavfilter6-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavcodec-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavformat-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavformat57-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavresample-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavresample3-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavcodec-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavformat-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavformat57-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavresample-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavresample3-3.4.2-4.27.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193184-1/ https://www.suse.com/security/cve/CVE-2019-17542.html CVE-2019-17542 https://bugzilla.suse.com/1154064 SUSE Bug 1154064 In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf. CVE-2019-9718 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libavcodec57-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libavutil-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libavutil55-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libpostproc-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libpostproc54-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libswresample-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libswresample2-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libswscale-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libswscale4-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libavcodec57-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libavutil-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libavutil55-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libpostproc-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libpostproc54-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libswresample-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libswresample2-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libswscale-devel-3.4.2-4.27.1 SUSE Linux Enterprise Module for Desktop Applications 15:libswscale4-3.4.2-4.27.1 SUSE Linux Enterprise Module for Package Hub 15:ffmpeg-3.4.2-4.27.1 SUSE Linux Enterprise Module for Package Hub 15:libavdevice57-3.4.2-4.27.1 SUSE Linux Enterprise Module for Package Hub 15:libavfilter6-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavcodec-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavformat-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavformat57-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavresample-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15 SP1:libavresample3-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavcodec-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavformat-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavformat57-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavresample-devel-3.4.2-4.27.1 SUSE Linux Enterprise Workstation Extension 15:libavresample3-3.4.2-4.27.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193184-1/ https://www.suse.com/security/cve/CVE-2019-9718.html CVE-2019-9718 https://bugzilla.suse.com/1129715 SUSE Bug 1129715