PT-2023-4440 · Libde265+3 · Libde265+3

Jieyong Mao · Publicado 2023-01-30 · Atualizado 2024-02-26 · CVE-2023-25221

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Libde265 version 1.0.10

Description The issue is related to a heap-buffer-overflow vulnerability in the derive spatial luma vector prediction function in motion.cc of the Libde265 video codec implementation. This vulnerability can be exploited to gain access to confidential data, compromise data integrity, and cause a denial of service.

Recommendations For Libde265 version 1.0.10, update to version 1.0.11 to fix the security issues. As a temporary workaround, consider restricting access to the derive spatial luma vector prediction function in motion.cc until the update is applied.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

BDU:2023-04826

CVE-2023-25221

DLA-3352-1

DSA-5346-1

MGASA-2023-0093

USN-6659-1

Produtos afetados

Astra Linux

Libde265

Linuxmint

Ubuntu

Referências · 39

• 🔥 https://github.com/strukturag/libde265/issues/388 · Exploit
• https://github.com/strukturag/libde265/commit/857290982330e82d9e25d9d39527c6737021aa7d · Nota
• https://t.me/cvenotify/45977 · Publicação no Telegram
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2023-0093 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2022-43245 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-25221 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-25221 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2023/03/msg00004.html · Nota
• https://osv.dev/vulnerability/DLA-3352-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-5346-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-25221 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-24754 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-6659-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-25221 · Nota de Segurança