From nobody Fri Apr 7 12:26:19 2023 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4PtHfN2739z44ZjF; Fri, 7 Apr 2023 12:26:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4PtHfN1dPnz3nMy; Fri, 7 Apr 2023 12:26:20 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1680870380; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Mmy1UL0CRh/ugGCqDi4/j+B+QuCEwusrl8Rgff2FrIQ=; b=aI5Emprk321hGZWj+/xbIXj5HtZapEtrQryD1TSoC4M439BgSUqF0yjs0ROOrnh9z8HCes WAQqCFX4ejEPDt9MkzIZrNReBVfThPaZRgNT/AIMIBhgsBdDhE2pK8sSUfMqyRb2Tv7BjT d/s3r9GXJXrrPLE5M4GLSfjJe41sjB+ElTYyFZNs3+S9bLZ7uPa5xzfPr6kdY4sCZJHP+i 29pAuLPyZibtkP0Vn3Shyc8hEZKg1cxuAI70YXrXXAwQJrjLfESRJvSzHZAvwUWQmg92hT jtxTL2yFvBqtoWFBA98NENENMhnDfBXPptoaVNBtUHfm8WCe40o3IvDi26PI4A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1680870380; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Mmy1UL0CRh/ugGCqDi4/j+B+QuCEwusrl8Rgff2FrIQ=; b=QKbgOTmc2rUub1Ltl5fRwz80ZB1C4nZXDOg6fRPvruCm09F2X2jy6Z2KtQWpZVG8PW1fv7 QhyDD7AuYPGoYx35E/9cGsQ85lBayfC8Q+R11IpwKyavS7Txaw2NMgv2q5ygeA5jNOQyx6 mnT2gY2t4kj9GIXlBmcaiuSE3GAGXFAsLqgdnNLQAKr3+jpJL0tRIV7I0npZ2BxCii6flR 08H+jJE1J7a+RM39BgOsZWJPRE7KMvSGsHsXOiE2nzOvsHqqWTn8OvQiZrlAO1NLvwGAzV LkILm9Hb8RqdV0+iNrN5sidM8691FBMKplhg3Uo57JiEVzuSiJJE/OWoZ3RwXg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1680870380; a=rsa-sha256; cv=none; b=C6G3itwmwM65lXRxpYL/Zq95pr0xsUxVimpDWCR5qNCSiDQDVJSI2c4xQZPKaxm1C+bV0l ExPKC99+u/5NV0PrRD8eI31FJNQLI+3R0KKLaAxpAS2NeYDZPEV9zpdsQX0lwPJdlxzYOV rvBdtehYuL2kIYHuYh9okHRwoRlmUdY9IrtoUXfLlhEiceaq9tA6oYfY72uPQfB40xTJ2W QAIjU8wDOj1vJvd/djfvZ8BUxHOwt78mUUCl+dILfrgJW/fEWgGA1hXke4MEUQNzHrSTTL f8zqBDDywNWQGqFNQqmSLazIBHoN3d5ML6pAlBgE7Vuk+eZJYpL00fXQh+U+kA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4PtHfN0cNyzlXH; Fri, 7 Apr 2023 12:26:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 337CQJGB016388; Fri, 7 Apr 2023 12:26:19 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 337CQJ7w016387; Fri, 7 Apr 2023 12:26:19 GMT (envelope-from git) Date: Fri, 7 Apr 2023 12:26:19 GMT Message-Id: <202304071226.337CQJ7w016387@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Jan Beich Subject: git: 3c7bdc427a09 - main - security/vuxml: mark ffmpeg < 5.0.3,1 as vulnerable List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-main@freebsd.org X-BeenThere: dev-commits-ports-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jbeich X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 3c7bdc427a0960a9b8204ac91f471d26fc6b9fb7 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by jbeich: URL: https://cgit.FreeBSD.org/ports/commit/?id=3c7bdc427a0960a9b8204ac91f471d26fc6b9fb7 commit 3c7bdc427a0960a9b8204ac91f471d26fc6b9fb7 Author: Jan Beich AuthorDate: 2023-04-07 12:02:56 +0000 Commit: Jan Beich CommitDate: 2023-04-07 12:25:37 +0000 security/vuxml: mark ffmpeg < 5.0.3,1 as vulnerable --- security/vuxml/vuln/2023.xml | 81 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 81 insertions(+) diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index 9e8206b86555..e532db04b3be 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -1,3 +1,84 @@ + + ffmpeg -- multiple vulnerabilities + + + ffmpeg + 5.0.3,1 + + + ffmpeg4 + + 0 + + + avidemux + + 2.9 + + + emby-server + emby-server-devel + + + 0 + + + handbrake + + 1.6.0 + + + mythtv + mythtv-frontend + + 33.0,1 + + + + +

NVD reports:

+
+

An issue was discovered in the FFmpeg package, where + vp3_decode_frame in libavcodec/vp3.c lacks check of the + return value of av_malloc() and will cause a null pointer + dereference, impacting availability.

+
+
+

A null pointer dereference issue was discovered in + 'FFmpeg' in decode_main_header() function of + libavformat/nutdec.c file. The flaw occurs because the + function lacks check of the return value of + avformat_new_stream() and triggers the null pointer + dereference error, causing an application to crash.

+
+
+

A vulnerability classified as problematic has been found + in ffmpeg. This affects an unknown part of the file + libavcodec/rpzaenc.c of the component QuickTime RPZA Video + Encoder. The manipulation of the argument y_size leads to + out-of-bounds read. It is possible to initiate the attack + remotely. The name of the patch is + 92f9b28ed84a77138105475beba16c146bdaf984. It is recommended + to apply a patch to fix this issue. The associated + identifier of this vulnerability is VDB-213543.

+
+ + + + CVE-2022-3109 + CVE-2022-3341 + CVE-2022-3964 + https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/2cdddcd6ec90c7a248ffe792d85faa4d89eab9f7 + https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/481e81be1271ac9a0124ee615700390c2371bd89 + https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/1eb002596e3761d88de4aeea3158692b82fb6307 + https://ffmpeg.org/security.html + + + 2022-11-12 + 2023-03-07 + + + mediawiki -- multiple vulnerabilities