PT-2022-6510 · Libde265+3 · Libde265+3

Xidoo123 · Published 2022-12-18 · Updated 2025-03-07 · CVE-2022-47664

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Libde265 version 1.0.9

Description The issue is related to a buffer overflow in the ff hevc put hevc qpel pixels 8 sse function of the Libde265 h.265 video codec implementation. This vulnerability is caused by copying a buffer without checking the size of the input data. Exploitation of this issue may allow an attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For Libde265 version 1.0.9, update to version 1.0.11 to fix the security issues. As a temporary workaround, consider disabling the ff hevc put hevc qpel pixels 8 sse function until a patch is available.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

ALT-PU-2023-1213

BDU:2023-01833

CVE-2022-47664

DLA-3352-1

DSA-5346-1

MGASA-2023-0093

Affected Products

Alt Linux

Astra Linux

Libde265

Red Os

References · 23

• 🔥 https://github.com/strukturag/libde265/issues/368 · Exploit
• https://debian.org/lts/security/2022/dla-3240 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-47664 · Vendor Advisory
• https://debian.org/security/2023/dsa-5346 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0093 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01833 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-47664 · Vendor Advisory
• https://debian.org/lts/security/2023/dla-3280 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5346-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-47664 · Vendor Advisory
• https://debian.org/lts/security/2023/dla-3352 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47664 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0426SE17 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3352-1 · Vendor Advisory