Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2014.1355
libav security update
11 August 2014
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: libav
Publisher: Debian
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Debian GNU/Linux 7
Impact/Access: Denial of Service -- Remote with User Interaction
Reduced Security -- Unknown/Unspecified
Resolution: Patch/Upgrade
CVE Names: CVE-2014-2263 CVE-2013-3674 CVE-2013-3672
CVE-2013-0868 CVE-2013-0860 CVE-2013-0852
CVE-2013-0851 CVE-2013-0848 CVE-2011-3946
CVE-2011-3935 CVE-2011-3934
Original Bulletin:
http://www.debian.org/security/2014/dsa-3003
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running libav check for an updated version of the software for their
operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3003-1 security@debian.org
http://www.debian.org/security/ Moritz Muehlenhoff
August 10, 2014 http://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : libav
CVE ID : CVE-2011-3934 CVE-2011-3935 CVE-2011-3946 CVE-2013-0848
CVE-2013-0851 CVE-2013-0852 CVE-2013-0860 CVE-2013-0868
CVE-2013-3672 CVE-2013-3674 CVE-2014-2263
Several security issues have been corrected in multiple demuxers and
decoders of the libav multimedia library. A full list of the changes is
available at
http://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v0.8.15
For the stable distribution (wheezy), these problems have been fixed in
version 6:0.8.15-1.
For the unstable distribution (sid), these problems will be fixed soon.
We recommend that you upgrade your libav packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBAgAGBQJT5+PNAAoJEBDCk7bDfE425zcQAJ4KWFLPmLMYNeih/w8V2SL4
q3iE/E6xaggPJjdOTYpadACgSRE9ucqaiPbm8bvYRmZebpVxleAUMqgcdr8iegSO
89ctC4yuLGhYltWq01P9r++2SDc52Q+yTfh//eVzY5eB7iwRxPvSK1GLFweJWxkH
tCcEIpeC46vM6qeR67ikYblC39AdjRBo/tWu6ygd3xB/htsQ97WauDUW6npCSj6m
nrQ6ZXkMC6iHI0qjcDqGngnS6N425/I1abrQTDW/xeOzPvUMLhz8obrPIysyQF/n
KGCg/+SB7fx7QAQ/iQ+8mRj/Ip7D8ek1FIhz1/r9+DfhOVKz8eZPzhtsvuASLP8A
UH87cyyFOO812CQZ4moqz1jlq5kNncFSAv2UG9ZUT/mKOYePdaHE5DWlacY0WCPh
H6rjzo5xx5RiqzChCLu1W/BsiLHNrX6j+SgLesxXYYVnmaBh7SlIQQ+F589K+/mj
kCqZWHfFBVPAVBqy/UPGhWNxWTv9mnuxfx9JDk9uOeldMtsvn2B5nQlkfaxPxt3r
sfuOHIHwxvk0AjDPPETkAoH4pSPH8n8i9aeRxOy0SBTXTG5yG0uW5QU5kfAV3IHd
l+8B5s+auFEnbQlwls/dBnxt1FpNWt5LrMWuhZa+1aWt4SNSNeP2vtpN6PYARSQz
r1xXRvzhwtzSCV8AaQIY
=e/uh
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBU+hFCxLndAQH1ShLAQJdJRAAtriNoeq80fsi5uZGJ+vVjUtRKRoRYDST
KQrVMBxy/okkwXqMw53eeFCHCvS//7lf2iPJwrkv5ODBHKwYTbg4FT5x2QOiKFOq
+wkfcIdsP++bAmRE2uf6b+duINwWT2ojIw3p6RxhiiJnklN2qUqe8wN05tL5rGrI
dazdMNzO3YK5fovdL6rQpBNErZeZdF5a/HoytzZVConciDGxX7goS/6sbovJYz/v
nhAjSh8Tvf1qKBtMPtpc1aIoRGA6MeMm1ZwEhbL5I5Yh3hy+1Jzshxj0jIBIAdTF
IFMFrUNmgGmvVld+Z2jYi6orJzqXg/HcZsIsI9Xzm7A8At+aBOMKPGRDkXwIQUqK
JboSCbbUQtr+o4YYPtwN8fNPbzn9cE1voYke5jMHjvA/u+RhtSgvntYkdcPDPnlG
K839ay4YakIko3rtjkak0eKbr0Y1n2LGpKhcGTG5F7sVk7sBlQGVtyLs7RVd9bCp
gXD7z7hneFcGax6qYx0kL/T+DQL9/AIE5j4mtZxFeJ2HJf3EYwZIfwTK0V7ev7uX
7hjDZNuNwn6F0yzjaRLvO5CZjXoOXsYpJ+gVrmGtlAhSFR2P/5m0QT6rDTSz5ODV
ibPt6/rQjnw9bubgBJSYd222R96V3zLvyr0EBCSb1c3HgpjoUIfbEJnhqULNIK6S
es0aOiGsD6g=
=PAu6
-----END PGP SIGNATURE-----