Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.2545
ffmpeg security update
11 October 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: ffmpeg
Publisher: Debian
Operating System: Debian GNU/Linux 9
UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2017-14767 CVE-2017-14225 CVE-2017-14223
CVE-2017-14222 CVE-2017-14171 CVE-2017-14170
CVE-2017-14169 CVE-2017-14059 CVE-2017-14058
CVE-2017-14057 CVE-2017-14056 CVE-2017-14055
CVE-2017-14054
Original Bulletin:
http://www.debian.org/security/2017/dsa-3996
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running ffmpeg check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3996-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
October 10, 2017 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : ffmpeg
CVE ID : CVE-2017-14054 CVE-2017-14055 CVE-2017-14056
CVE-2017-14057 CVE-2017-14058 CVE-2017-14059
CVE-2017-14169 CVE-2017-14170 CVE-2017-14171
CVE-2017-14222 CVE-2017-14223 CVE-2017-14225
CVE-2017-14767
Several vulnerabilities have been discovered in the FFmpeg multimedia
framework, which could result in denial of service or potentially the
execution of arbitrary code if malformed Real, MV, RL2, ASF, Apple HLS,
Phantom Cine, MXF, NSV, MOV or RTP H.264 files/streams are processed.
For the stable distribution (stretch), these problems have been fixed in
version 7:3.2.8-1~deb9u1.
We recommend that you upgrade your ffmpeg packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlndHbsACgkQEMKTtsN8
TjYeVw/9FN2TvZK7EGX5m+ub03GdsSRpB/gFACuL+N8JapVaH+q0fXmPQQ8LC9zc
MG0Ne4L6LDsjekpWgp5c56aH7gOjYSLEnfh3GcZpfswXI+HRhHQaVWoMy4dDqw07
IenPhvUvprTWKYb6HL4E8Tw6fkAIbXWZ0NVExfsL+1isyPq7Tu2wgVzGDLAmAuep
Rsjm4zuhrMgT5v+Hsf626RGhghg8en0WHkHj4NYQ+INHXcc9fxm41l99Uewy5gA+
dKcnQ4vPFrWufx6SqfEZPOQ5T968oMmAH5YWOG+T6/hWi43QvpPmVOzMirs2H3tj
mq7FjCBeoSB5bJSiYn95TaraEW7Ikn4PiQvitBwTizC5varIVj1+V8GebthhN4YA
bSYc2L4IoT5JRE+5cVp1PoY/Qs45C1Bbp7UXJgqy7wtm/sVSuVFoZum4Y/ox5cI3
AVT+af33T3gMNQ6dMUzkHF4h9QEO39/+UO7QYOL79DTvAKjtsgjCA7/rGo4gb7hr
3w/zl/fnGE//TVbDAOYYkChibgY/6aJIkPYcnnGIIvLQb8aHQ1lmjIyvdxFrMmFR
45BfD12UrwOKq6RoUPloO5DEUCn7s2eX0s/qDh2oZm5y78aphmNOOh1uxWQoVH5a
jyOrIbZLO3ckXKv/wJE0BxTIegPb8j1TmfnM90A/4Pvc8HMAvrY=
=7NY4
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWd2SsYx+lLeg9Ub1AQhxkg/9GtYU3ZG3t3DX0/xXaaEALeVZ9tI8JgTI
9l5ViAXc6c0rPUTkeGqoMZgvo7Zr5fa0WTfvBeg+LJ+QD3TJfbZfNcno6SBumxc5
7rvxG69wlBHzycU2WXqYiUdupSnvn2BXH080v7kFIZJR+gRyDJZBMpKVzXW7Cr1v
E5K2vSm8eC+yl73RwbErToVxjAKMt+8n5Gxp76Y6a6CRO37Ex45vVpylb8ondTAk
ddZNekUDOO5eyj3E8HYmcqUa6gRDawZjjvaFgBBHFYtsaW+Wi8WiFn9xpFX+Q2CT
Q2Awr7zaHwCBFuqurI0PiiyBuZjABCZ0dCurr8Oiw2Y6MgwUvMfsShbIMX1QfcLm
Vh0PnOkNXTEZRA87t81qVmzSwA6OyJWo8N6+WA+55h0vhEsabzgzt9IZaP6z+cnq
WryaxuX2488DCQ+7eYnmDSicRCmAhNa4AbnTfBEQ6CHhAYkqaTrRZyPzundES/nc
n6JEP9i6HhBUrMHzDrfrLFdGSNrQJihoLTDyjgCw/I1/xu+nyN0lGsQlMbMx+HwJ
jKpaKbXWY+QZRU37K5h/Jcy7sZZ5JezxM2XaSbp/nm1d+s3RLLa9KYCMsYe2Kv9m
Cx9DSfU8WE5Pn3eo8217Su6ti2FPIKX/vCBiapvH8giUW2lrcO+vIMtpYlUq5gtr
qimqZeVb728=
=L//4
-----END PGP SIGNATURE-----