Security update for libaom SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:4170-1 Final 1 1 2021-12-23T08:54:03Z current 2021-12-23T08:54:03Z 2021-12-23T08:54:03Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libaom This update for libaom fixes the following issues: - CVE-2020-36129: Fixed stack buffer overflow via the component src/aom_image.c (bsc#1193356). - CVE-2020-36131: Fixed stack buffer overflow via the component stats/rate_hist.c (bsc#1193365). - CVE-2020-36135: Fixed NULL pointer dereference via the component rate_hist.c (bsc#1193366). - CVE-2020-36130: Fixed NULL pointer dereference via the component av1/av1_dx_iface.c (bsc#1193369). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-4170,SUSE-SLE-Module-Desktop-Applications-15-SP2-2021-4170,SUSE-SLE-Module-Desktop-Applications-15-SP3-2021-4170 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20214170-1/ Link for SUSE-SU-2021:4170-1 https://lists.suse.com/pipermail/sle-security-updates/2021-December/009940.html E-Mail link for SUSE-SU-2021:4170-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1193356 SUSE Bug 1193356 https://bugzilla.suse.com/1193365 SUSE Bug 1193365 https://bugzilla.suse.com/1193366 SUSE Bug 1193366 https://bugzilla.suse.com/1193369 SUSE Bug 1193369 https://www.suse.com/security/cve/CVE-2020-36129/ SUSE CVE CVE-2020-36129 page https://www.suse.com/security/cve/CVE-2020-36130/ SUSE CVE CVE-2020-36130 page https://www.suse.com/security/cve/CVE-2020-36131/ SUSE CVE CVE-2020-36131 page https://www.suse.com/security/cve/CVE-2020-36135/ SUSE CVE CVE-2020-36135 page SUSE Linux Enterprise Module for Desktop Applications 15 SP2 SUSE Linux Enterprise Module for Desktop Applications 15 SP3 aom-tools-1.0.0-3.9.1 libaom-devel-1.0.0-3.9.1 libaom-devel-doc-1.0.0-3.9.1 libaom0-1.0.0-3.9.1 libaom0-32bit-1.0.0-3.9.1 libaom0-64bit-1.0.0-3.9.1 libaom0-1.0.0-3.9.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP2 libaom0-1.0.0-3.9.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP3 AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c. CVE-2020-36129 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:libaom0-1.0.0-3.9.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:libaom0-1.0.0-3.9.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20214170-1/ https://www.suse.com/security/cve/CVE-2020-36129.html CVE-2020-36129 https://bugzilla.suse.com/1193356 SUSE Bug 1193356 AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c. CVE-2020-36130 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:libaom0-1.0.0-3.9.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:libaom0-1.0.0-3.9.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20214170-1/ https://www.suse.com/security/cve/CVE-2020-36130.html CVE-2020-36130 https://bugzilla.suse.com/1193369 SUSE Bug 1193369 AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c. CVE-2020-36131 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:libaom0-1.0.0-3.9.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:libaom0-1.0.0-3.9.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20214170-1/ https://www.suse.com/security/cve/CVE-2020-36131.html CVE-2020-36131 https://bugzilla.suse.com/1193365 SUSE Bug 1193365 AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c. CVE-2020-36135 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:libaom0-1.0.0-3.9.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:libaom0-1.0.0-3.9.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20214170-1/ https://www.suse.com/security/cve/CVE-2020-36135.html CVE-2020-36135 https://bugzilla.suse.com/1193366 SUSE Bug 1193366