Jieyong Mao

**Name of the Vulnerable Software and Affected Versions** GNU LibreDWG version 0.12.5 **Description** A heap-based buffer overflow issue exists via the `bit read RC` function at `bits.c`. **Recommendations** For GNU LibreDWG version 0.12.5, consider disabling the `bit read RC` function as a temporary workaround until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Libde265 version 1.0.10 **Description** The issue is related to a heap-buffer-overflow vulnerability in the `derive spatial luma vector prediction` function in `motion.cc` of the Libde265 video codec implementation. This vulnerability can be exploited to gain access to confidential data, compromise data integrity, and cause a denial of service. **Recommendations** For Libde265 version 1.0.10, update to version 1.0.11 to fix the security issues. As a temporary workaround, consider restricting access to the `derive spatial luma vector prediction` function in `motion.cc` until the update is applied.

**Name of the Vulnerable Software and Affected Versions** libde265 version 1.0.10 **Description** The issue is related to a NULL pointer dereference in the `put weighted pred 8 fallback` function at `fallback-motion.cc`. This allows attackers to cause a Denial of Service (DoS) via a crafted input file. **Recommendations** For libde265 version 1.0.10, update to version 1.0.11 to fix the security issue. As a temporary workaround, consider avoiding the use of the `put weighted pred 8 fallback` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** libde265 version 1.0.10 **Description** The issue is related to a NULL pointer dereference in the `put unweighted pred 16 fallback` function at `fallback-motion.cc`. This allows attackers to cause a Denial of Service (DoS) via a crafted input file. **Recommendations** For libde265 version 1.0.10, update to version 1.0.11 to fix the security issue. As a temporary workaround, consider restricting the use of the `put unweighted pred 16 fallback` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** libde265 version 1.0.10 **Description** The issue is related to a NULL pointer dereference in the `ff hevc put weighted pred avg 8 sse` function at `sse-motion.cc`. This allows attackers to cause a Denial of Service (DoS) via a crafted input file. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** For libde265 version 1.0.10, update to version 1.0.11 to fix the security issue. As a temporary workaround, consider avoiding the use of the `ff hevc put weighted pred avg 8 sse` function until a patch is available. Restrict access to crafted input files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** libde265 version 1.0.10 **Description** The issue is related to a NULL pointer dereference in the `ff hevc put unweighted pred 8 sse` function at `sse-motion.cc`. This allows attackers to cause a Denial of Service (DoS) via a crafted input file. **Recommendations** For libde265 version 1.0.10, update to version 1.0.11 to fix the security issue. As a temporary workaround, consider avoiding the use of the `ff hevc put unweighted pred 8 sse` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** libde265 version 1.0.10 **Description** The issue is related to a NULL pointer dereference in the `ff hevc put weighted pred avg 8 sse` function at `sse-motion.cc` in the libde265 video codec implementation. This allows attackers to cause a Denial of Service (DoS) via a crafted input file. **Recommendations** For libde265 version 1.0.10, update to version 1.0.11 to fix the security issue. As a temporary workaround, consider restricting the use of the `ff hevc put weighted pred avg 8 sse` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** libde265 version 1.0.10 **Description** The issue is related to a NULL pointer dereference in the `ff hevc put hevc epel pixels 8 sse` function at `sse-motion.cc`. This allows attackers to cause a Denial of Service (DoS) via a crafted input file. **Recommendations** For libde265 version 1.0.10, update to version 1.0.11 to fix the security issue. As a temporary workaround, consider avoiding the use of the `ff hevc put hevc epel pixels 8 sse` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** libde265 version 1.0.10 **Description** The issue is related to a NULL pointer dereference in the `mc chroma` function at `motion.cc` in the libde265 video codec implementation. This allows an attacker to cause a Denial of Service (DoS) via a crafted input file. The exploitation of this issue can be done remotely. **Recommendations** For libde265 version 1.0.10, update to version 1.0.11 to fix the security issues. As a temporary workaround, consider restricting the use of the `mc chroma` function in `motion.cc` to minimize the risk of exploitation. Avoid using crafted input files that could trigger the NULL pointer dereference in the `mc chroma` function until the issue is resolved.