PT-2023-4440 · Libde265+3 · Libde265+3

Jieyong Mao · Published 2023-01-30 · Updated 2024-02-26 · CVE-2023-25221

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Libde265 version 1.0.10

Description The issue is related to a heap-buffer-overflow vulnerability in the derive spatial luma vector prediction function in motion.cc of the Libde265 video codec implementation. This vulnerability can be exploited to gain access to confidential data, compromise data integrity, and cause a denial of service.

Recommendations For Libde265 version 1.0.10, update to version 1.0.11 to fix the security issues. As a temporary workaround, consider restricting access to the derive spatial luma vector prediction function in motion.cc until the update is applied.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2023-04826

CVE-2023-25221

DLA-3352-1

DSA-5346-1

MGASA-2023-0093

USN-6659-1

Affected Products

Astra Linux

Libde265

Linuxmint

Ubuntu

References · 39

• 🔥 https://github.com/strukturag/libde265/issues/388 · Exploit
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0093 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43245 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-25221 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-25221 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3352-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5346-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-25221 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-24754 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6659-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25221 · Security Note
• https://debian.org/lts/security/2023/dla-3352 · Vendor Advisory
• https://debian.org/lts/security/2023/dla-3280 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-47665 · Vendor Advisory