PT-2022-7269 · Libde265+3 · Libde265+3

Peng Deng · Published 2022-02-11 · Updated 2025-01-28 · CVE-2022-43245

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Libde265 version 1.0.8

Description The issue is related to a segmentation violation via the apply sao internal function in sao.cc, which can be exploited to cause a Denial of Service (DoS) by using a crafted video file. This can be achieved by an attacker acting remotely. The vulnerability is associated with a buffer overflow in the apply sao internal<unsigned short> function.

Recommendations For Libde265 version 1.0.8, consider updating to version 1.0.11 to fix the security issues. As a temporary workaround, consider restricting the use of the apply sao internal function in sao.cc to minimize the risk of exploitation. Avoid using crafted video files that could trigger the Denial of Service (DoS) until the issue is resolved.

Exploit

Fix

DoS

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

BDU:2024-01605

CVE-2022-43245

DLA-3280-1

DSA-5346-1

MGASA-2023-0093

ROSA-SA-2025-2630

ROSA-SA-2025-2631

USN-6659-1

Affected Products

Astra Linux

Libde265

Linuxmint

Ubuntu

References · 39

• 🔥 https://github.com/strukturag/libde265/issues/352 · Exploit
• https://ubuntu.com/security/CVE-2022-43244 · Vendor Advisory
• https://debian.org/lts/security/2022/dla-3240 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-24754 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-24755 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0093 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-43245 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01605 · Security Note
• https://ubuntu.com/security/CVE-2023-25221 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-43245 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-24751 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43245 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0093.html · Security Note
• https://ubuntu.com/security/notices/USN-6659-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43250 · Vendor Advisory