PT-2022-7252 · Libde265+3 · Libde265+3
Published
2022-10-10
·
Updated
2025-01-28
·
CVE-2022-43240
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Libde265 version 1.0.8
Description
The issue is related to a heap-buffer-overflow vulnerability via the
ff hevc put hevc qpel h 2 v 1 sse function in sse-motion.cc. This allows attackers to cause a Denial of Service (DoS) via a crafted video file. The vulnerability can be exploited by a remote attacker using a specially crafted video file, leading to a service disruption.Recommendations
For Libde265 version 1.0.8, update to version 1.0.11 to fix the security issue. As a temporary workaround, consider restricting the use of the
ff hevc put hevc qpel h 2 v 1 sse function in sse-motion.cc until a patch is available. Avoid using crafted video files that could exploit the vulnerability.Exploit
Fix
DoS
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Libde265
Linuxmint
Ubuntu