Bug 13595

I just noticed that http://ffmpeg.org/security.html lists some CVEs that are relevant for this update.  I may or may not have more details later.

Fixed in 1.1.9 - CVE-2012-5150, CVE-2014-209[789], CVE-2014-2263

Advisory:
========================

Updated ffmpeg packages fix security vulnerabilities:

This updates provides ffmpeg version 1.1.11, which fixes several unspecified
security vulnerabilities and other bugs which were corrected upstream.

References:
http://git.videolan.org/?p=ffmpeg.git;a=log;h=n1.1.11
http://ffmpeg.org/olddownload.html
http://ffmpeg.org/security.html

Component: RPM Packages => Security
QA Contact: (none) => security

I asked in #ffmpeg-devel about any other issues that may have been fixed in 1.1.10 and 1.1.11.

<michaelni> Luigi12_work, i suggest you wait a day or 2 before updating from packages from branch theres some backports pending
<michaelni> packages from 1.1 branch
<Luigi12_work> michaelni: are these backports pending for 2.0.x as well?
<michaelni> yes, ill try to get them out ASAP

So let's hold this one until next week.

Whiteboard: has_procedure => has_procedure feedback

1.1.12 has been tagged in git, so we should be able to update it soon.  It hasn't been announced yet, and I'm still waiting on their security page to be updated.

The ffmpeg webpages have been updated.  Version 1.1.12 is out, which also fixes CVE-2014-4609 and CVE-2014-4610.

(In reply to David Walser from comment #4)
> The ffmpeg webpages have been updated.  Version 1.1.12 is out, which also
> fixes CVE-2014-4609 and CVE-2014-4610.

Information on those CVEs:
http://openwall.com/lists/oss-security/2014/06/26/22
http://openwall.com/lists/oss-security/2014/06/26/23

(In reply to David Walser from comment #5)
> (In reply to David Walser from comment #4)
> > The ffmpeg webpages have been updated.  Version 1.1.12 is out, which also
> > fixes CVE-2014-4609 and CVE-2014-4610.
> 
> Information on those CVEs:
> http://openwall.com/lists/oss-security/2014/06/26/22
> http://openwall.com/lists/oss-security/2014/06/26/23

It looks like CVE-2014-4610 is actually the appropriate CVE to use (being for ffmpeg, CVE-2014-4609 being the same for the libav fork).  The issue is an integer overflow in LZO decompression.

Updated packages uploaded for Mageia 3.

Note to QA: there are core and tainted builds for this package.

Advisory:
========================

Updated ffmpeg packages fix security vulnerabilities:

A use-after-free vulnerability in FFmpeg before 1.1.9 involving seek
operations on video data could allow remote attackers to cause a denial of
service (CVE-2012-5150).

The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 1.1.9
does not properly validate a certain bits-per-sample value, which allows
remote attackers to cause a denial of service (out-of-bounds array access)
or possibly have unspecified other impact via crafted TAK (aka Tom's
lossless Audio Kompressor) data (CVE-2014-2097).

libavcodec/wmalosslessdec.c in FFmpeg before 1.1.9 uses an incorrect
data-structure size for certain coefficients, which allows remote attackers
to cause a denial of service (memory corruption) or possibly have
unspecified other impact via crafted WMA data (CVE-2014-2098).

The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before 1.1.9
does not properly calculate line sizes, which allows remote attackers to
cause a denial of service (out-of-bounds array access) or possibly have
unspecified other impact via crafted Microsoft RLE video data
(CVE-2014-2099).

The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer
(libavformat/mpegtsenc.c) in FFmpeg before 1.1.9 allows remote attackers to
have unspecified impact and vectors, which trigger an out-of-bounds write
(CVE-2014-2263).

An integer overflow in LZO decompression in FFmpeg before 1.1.12 allows
remote attackers to have an unspecified impact by embedding compressed data
in a video file (CVE-2014-4610).

This updates provides ffmpeg version 1.1.12, which fixes these issues and
several other bugs which were corrected upstream.

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5150
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2097
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2098
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2099
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2263
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4610
http://git.videolan.org/?p=ffmpeg.git;a=log;h=n1.1.12
http://ffmpeg.org/olddownload.html
http://ffmpeg.org/security.html
http://openwall.com/lists/oss-security/2014/06/26/23
========================

Updated packages in {core,tainted}/updates_testing:
========================
ffmpeg-1.1.12-1.mga3
libavcodec54-1.1.12-1.mga3
libpostproc52-1.1.12-1.mga3
libavformat54-1.1.12-1.mga3
libavutil52-1.1.12-1.mga3
libswscaler2-1.1.12-1.mga3
libavfilter3-1.1.12-1.mga3
libswresample0-1.1.12-1.mga3
libffmpeg-devel-1.1.12-1.mga3
libffmpeg-static-devel-1.1.12-1.mga3

from ffmpeg-1.1.12-1.mga3.src.rpm

Summary: ffmpeg update to 1.1.11 => ffmpeg update to 1.1.12
Whiteboard: has_procedure feedback => has_procedure
Severity: normal => major

Tested mga3_64 & mga3_32,

(1) Testing complete for the new ffmpeg-1.1.12-1.mga3, all seems works fine for me.

I used it to convert an :
->.wmv video file to a .avi video file =Ok
->.wmv video file to a .mkv video file =Ok
->.wmv video file to a .flv video file =Ok
->.wmv video file to a .mpg video file =Ok
->.wmv video file to a .mov video file =Not Ok (Need the Tainted)

->.mkv video file to a .avi video file =Ok
->.mkv video file to a .flv video file =Ok
->.mkv video file to a .wmv video file =Ok
->.mkv video file to a .mpg video file =Ok
->.mkv video file to a .mov video file =Not Ok (Need the Tainted)

(2) Testing complete for the new ffmpeg-1.1.12-1.mga3.tainted, all seems works fine for me too.

I used it to convert an :
->.wmv video file to a .avi video file =Ok
->.wmv video file to a .mkv video file =Ok
->.wmv video file to a .flv video file =Ok
->.wmv video file to a .mpg video file =Ok
->.wmv video file to a .mov video file =Ok

->.mkv video file to a .avi video file =Ok
->.mkv video file to a .flv video file =Ok
->.mkv video file to a .wmv video file =Ok
->.wmv video file to a .mpg video file =Ok
->.mkv video file to a .mov video file =Ok

CC: (none) => geiger.david68210
Whiteboard: has_procedure => has_procedure MGA3-64-OK MGA3-32-OK

Tested mga4_64 & mga4_32,

(1) Testing complete for the new ffmpeg-2.0.5-1.mga4, all seems works fine for me.

I used it to convert an :
->.wmv video file to a .avi video file =Ok
->.wmv video file to a .mkv video file =Ok
->.wmv video file to a .flv video file =Ok
->.wmv video file to a .mpg video file =Ok
->.wmv video file to a .mov video file =Not Ok (Need the Tainted)

->.mkv video file to a .avi video file =Ok
->.mkv video file to a .flv video file =Ok
->.mkv video file to a .wmv video file =Ok
->.mkv video file to a .mpg video file =Ok
->.mkv video file to a .mov video file =Not Ok (Need the Tainted)

(2) Testing complete for the new ffmpeg-2.0.5-1.mga4.tainted, all seems works fine for me too.

I used it to convert an :
->.wmv video file to a .avi video file =Ok
->.wmv video file to a .mkv video file =Ok
->.wmv video file to a .flv video file =Ok
->.wmv video file to a .mpg video file =Ok
->.wmv video file to a .mov video file =Ok

->.mkv video file to a .avi video file =Ok
->.mkv video file to a .flv video file =Ok
->.mkv video file to a .wmv video file =Ok
->.wmv video file to a .mpg video file =Ok
->.mkv video file to a .mov video file =Ok

Whiteboard: has_procedure MGA3-64-OK MGA3-32-OK => has_procedure MGA3-64-OK MGA3-32-OK MGA4-64-OK MGA4-32-OK

The Mageia 4 update is in Bug 13594.  Thanks for testing.

Whiteboard: has_procedure MGA3-64-OK MGA3-32-OK MGA4-64-OK MGA4-32-OK => has_procedure MGA3-64-OK MGA3-32-OK

Ouppps!! sorry it is bad for mga4 (that's another bug) :)

Update validated and advisory uploaded.

Please push ffmpeg to Mageia 3 {core,tainted}/updates.

Keywords: (none) => validated_update
Whiteboard: has_procedure MGA3-64-OK MGA3-32-OK => has_procedure MGA3-64-OK MGA3-32-OK advisory
CC: (none) => remi, sysadmin-bugs

Update pushed:
http://advisories.mageia.org/MGASA-2014-0281.html

Status: NEW => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED