MGASA-2019-0029

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2019-0029.html
Import Source
https://advisories.mageia.org/MGASA-2019-0029.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2019-0029
Related
Published
2019-01-10T10:53:49Z
Modified
2019-01-10T10:24:33Z
Summary
Updated live, ffmpeg, mplayer, and vlc packages fix security vulnerabilities
Details

A bug in the server implementation of RTSP-over-HTTP in live could allow a denial-of-service attack.

A bug in the server implementation of RTSP-over-HTTP could allow a buffer overflow, which could result in the execution of arbitrary code when parsing a malformed RTSP stream (CVE-2018-4013).

The flvwritepacket function in libavformat/flvenc.c in FFmpeg through 3.3.8 does not check for an empty audio packet, leading to an assertion failure (CVE-2018-15822).

The live package has been updated to version 2018.11.26, the ffmpeg package has been updated to version 3.3.9, and the vlc package has been updated to version 3.0.5, fixing these issues and other bugs.

The mplayer package has been rebuilt against the update live package to fix the RTSP-over-HTTP issues in mplayer.

References
Credits

Affected packages

Mageia:6 / ffmpeg

Package

Name
ffmpeg
Purl
pkg:rpm/mageia/ffmpeg?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.3.9-1.mga6.tainted

Ecosystem specific 

{
    "section": "tainted"
}

Mageia:6 / mplayer

Package

Name
mplayer
Purl
pkg:rpm/mageia/mplayer?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.0-13.mga6.tainted

Ecosystem specific 

{
    "section": "tainted"
}

Mageia:6 / vlc

Package

Name
vlc
Purl
pkg:rpm/mageia/vlc?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.5-2.mga6.tainted

Ecosystem specific 

{
    "section": "tainted"
}

Mageia:6 / live

Package

Name
live
Purl
pkg:rpm/mageia/live?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2018.11.26-1.mga6

Ecosystem specific 

{
    "section": "core"
}

Mageia:6 / ffmpeg

Package

Name
ffmpeg
Purl
pkg:rpm/mageia/ffmpeg?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.3.9-1.mga6

Ecosystem specific 

{
    "section": "core"
}

Mageia:6 / mplayer

Package

Name
mplayer
Purl
pkg:rpm/mageia/mplayer?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.0-13.mga6

Ecosystem specific 

{
    "section": "core"
}

Mageia:6 / vlc

Package

Name
vlc
Purl
pkg:rpm/mageia/vlc?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.5-2.mga6

Ecosystem specific 

{
    "section": "core"
}