PT-2022-6474 · Libde265+3 · Libde265+3

Dhbbbo · Published 2022-01-10 · Updated 2025-01-28 · CVE-2021-36411

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libde265 versions 1.0.8

Description The issue is related to incorrect access control in the derive boundaryStrength function of the deblock.cc component in the libde265 video codec implementation. This can cause a segmentation fault and application crash, leading to a remote denial of service. The vulnerability is exploited by a READ memory access error in the derive boundaryStrength function.

Recommendations For libde265 version 1.0.8, update to version 1.0.11 to fix the security issue. As a temporary workaround, consider restricting access to the derive boundaryStrength function of deblock.cc to minimize the risk of exploitation.

Exploit

Fix

DoS

Out of bounds Read

Improper Resource Release

Weakness Enumeration

CWE-125

CWE-404

Related Identifiers

BDU:2023-01687

CVE-2021-36411

DLA-3240-1

DSA-5346-1

MGASA-2023-0093

ROSA-SA-2025-2630

ROSA-SA-2025-2631

USN-6627-1

Affected Products

Astra Linux

Linuxmint

Ubuntu

Libde265

References · 50

• 🔥 https://github.com/strukturag/libde265/issues/302 · Exploit
• https://debian.org/lts/security/2022/dla-3240 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43237 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0093 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43241 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43239 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36411 · Security Note
• https://ubuntu.com/security/CVE-2021-36410 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43235 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-36411 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43253 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43238 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-35452 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43242 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43243 · Vendor Advisory