PT-2022-7570 · Libde265+2 · Libde265+2

Xidoo123 · Published 2022-12-16 · Updated 2023-03-18 · CVE-2022-47655

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Libde265 version 1.0.9

Description The issue is related to a buffer overflow in the put qpel fallback() function of the Libde265 video codec implementation. This can allow an attacker to access confidential data, compromise data integrity, and cause a denial of service. The estimated number of potentially affected devices and details about real-world incidents are not provided.

Recommendations For Libde265 version 1.0.9, update to version 1.0.11 to fix the security issues. As a temporary workaround, consider disabling the put qpel fallback() function until a patch is available.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2023-1213

BDU:2024-07327

CVE-2022-47655

DLA-3280-1

DSA-5346-1

MGASA-2023-0093

Affected Products

Alt Linux

Astra Linux

Libde265

References · 24

• 🔥 https://github.com/strukturag/libde265/issues/367 · Exploit
• https://ubuntu.com/security/CVE-2022-47655 · Vendor Advisory
• https://debian.org/lts/security/2022/dla-3240 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3280-1 · Vendor Advisory
• https://debian.org/security/2023/dsa-5346 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0093 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47655 · Security Note
• https://debian.org/lts/security/2023/dla-3280 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07327 · Security Note
• https://osv.dev/vulnerability/DSA-5346-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-47655 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0303SE17MD · Vendor Advisory
• https://debian.org/lts/security/2023/dla-3352 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-47655 · Security Note
• https://advisories.mageia.org/MGASA-2023-0093.html · Security Note