[gentoo-announce] [ GLSA 201705-08 ] libav: Multiple vulnerabilities - gentoo-announce

From:	Kristian Fiskerstrand <k_f@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 201705-08 ] libav: Multiple vulnerabilities
Date:	Tue, 09 May 2017 19:56:44
Message-Id:	`be507c8f-5ac9-f1ef-35d1-27c9016f526c@gentoo.org`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 201705-08

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Normal

8

    Title: libav: Multiple vulnerabilities

9

     Date: May 09, 2017

10

     Bugs: #552320, #571870, #600706

11

       ID: 201705-08

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in libav, the worst of which

19

may allow execution of arbitrary code.

20

21

Background

22

==========

23

24

Libav is a complete solution to record, convert and stream audio and

25

video.

26

27

Affected packages

28

=================

29

30

    -------------------------------------------------------------------

31

     Package              /     Vulnerable     /            Unaffected

32

    -------------------------------------------------------------------

33

  1  media-video/libav             < 11.8                     >= 11.8

34

35

Description

36

===========

37

38

Multiple vulnerabilities have been discovered in libav. Please review

39

the CVE identifiers referenced below for details.

40

41

Impact

42

======

43

44

A remote attacker could entice a user to open a specially crafted media

45

file in an application linked against libav, possibly resulting in

46

execution of arbitrary code with the privileges of the application, a

47

Denial of Service condition or access the content of arbitrary local

48

files.

49

50

Workaround

51

==========

52

53

There is no known workaround at this time.

54

55

Resolution

56

==========

57

58

All libav users should upgrade to the latest version:

59

60

  # emerge --sync

61

  # emerge --ask --oneshot --verbose ">=media-video/libav-11.8"

62

63

References

64

==========

65

66

[ 1 ] CVE-2015-3395

67

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3395

68

[ 2 ] CVE-2015-3417

69

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3417

70

[ 3 ] CVE-2016-1897

71

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1897

72

[ 4 ] CVE-2016-1898

73

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1898

74

[ 5 ] CVE-2016-2326

75

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2326

76

[ 6 ] CVE-2016-3062

77

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3062

78

79

Availability

80

============

81

82

This GLSA and any updates to it are available for viewing at

83

the Gentoo Security Website:

84

85

 https://security.gentoo.org/glsa/201705-08

86

87

Concerns?

88

=========

89

90

Security is a primary focus of Gentoo Linux and ensuring the

91

confidentiality and security of our users' machines is of utmost

92

importance to us. Any security concerns should be addressed to

93

security@g.o or alternatively, you may file a bug at

94

https://bugs.gentoo.org.

95

96

License

97

=======

98

99

Copyright 2017 Gentoo Foundation, Inc; referenced text

100

belongs to its owner(s).

101

102

The contents of this document are licensed under the

103

Creative Commons - Attribution / Share Alike license.

104

105

http://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 201705-08
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: libav: Multiple vulnerabilities
9	Date: May 09, 2017
10	Bugs: #552320, #571870, #600706
11	ID: 201705-08
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in libav, the worst of which
19	may allow execution of arbitrary code.
20
21	Background
22	==========
23
24	Libav is a complete solution to record, convert and stream audio and
25	video.
26
27	Affected packages
28	=================
29
30	-------------------------------------------------------------------
31	Package / Vulnerable / Unaffected
32	-------------------------------------------------------------------
33	1 media-video/libav < 11.8 >= 11.8
34
35	Description
36	===========
37
38	Multiple vulnerabilities have been discovered in libav. Please review
39	the CVE identifiers referenced below for details.
40
41	Impact
42	======
43
44	A remote attacker could entice a user to open a specially crafted media
45	file in an application linked against libav, possibly resulting in
46	execution of arbitrary code with the privileges of the application, a
47	Denial of Service condition or access the content of arbitrary local
48	files.
49
50	Workaround
51	==========
52
53	There is no known workaround at this time.
54
55	Resolution
56	==========
57
58	All libav users should upgrade to the latest version:
59
60	# emerge --sync
61	# emerge --ask --oneshot --verbose ">=media-video/libav-11.8"
62
63	References
64	==========
65
66	[ 1 ] CVE-2015-3395
67	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3395
68	[ 2 ] CVE-2015-3417
69	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3417
70	[ 3 ] CVE-2016-1897
71	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1897
72	[ 4 ] CVE-2016-1898
73	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1898
74	[ 5 ] CVE-2016-2326
75	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2326
76	[ 6 ] CVE-2016-3062
77	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3062
78
79	Availability
80	============
81
82	This GLSA and any updates to it are available for viewing at
83	the Gentoo Security Website:
84
85	https://security.gentoo.org/glsa/201705-08
86
87	Concerns?
88	=========
89
90	Security is a primary focus of Gentoo Linux and ensuring the
91	confidentiality and security of our users' machines is of utmost
92	importance to us. Any security concerns should be addressed to
93	security@g.o or alternatively, you may file a bug at
94	https://bugs.gentoo.org.
95
96	License
97	=======
98
99	Copyright 2017 Gentoo Foundation, Inc; referenced text
100	belongs to its owner(s).
101
102	The contents of this document are licensed under the
103	Creative Commons - Attribution / Share Alike license.
104
105	http://creativecommons.org/licenses/by-sa/2.5