Updated vlc packages fix security vulnerabilities
Publication date: 05 Feb 2015Modification date: 05 Feb 2015
Type: security
Affected Mageia releases : 4
CVE: CVE-2014-9625 , CVE-2014-9626 , CVE-2014-9627 , CVE-2014-9628 , CVE-2014-9629 , CVE-2014-9630
Description
Updated vlc packages fix security vulnerabilities: On 32 bit builds, parsing of update status files with a size of 4294967295 or more lead to an integer truncation caused by a cast to size_t in a call to malloc and a subsequent buffer overflow. This happened prior to checking the files' signature (CVE-2014-9625). The MP4 demuxer, when parsing string boxes, did not properly check the length of the box, leading to a possible integer underflow when using this length value in a call to memcpy(). This could allow remote attackers to cause a denial of service (crash) or arbitrary code execution via crafted MP4 files (CVE-2014-9626). The MP4 demuxer, when parsing string boxes, did not properly check that the conversion of the box length from 64bit integer to 32bit integer on 32bit platforms did not cause a truncation, leading to a possible buffer overflow. This could allow remote attackers to cause a denial of service (crash) or arbitrary code execution via crafted MP4 files (CVE-2014-9627). The MP4 demuxer, when parsing string boxes, did not properly check the length of the box, leading to a possible buffer overflow. This could allow remote attackers to cause a denial of service (crash) or arbitrary code execution via crafted MP4 files (CVE-2014-9628). The Dirac and Schroedinger encoders did not properly check for an integer overflow on 32bit platforms, leading to a possible buffer overflow. This could allow remote attackers to cause a denial of service (crash) or arbitrary code execution (CVE-2014-9629). When streaming ogg-files via rtp, an ogg-file can trigger an invalid memory write access using an overly long 'configuration' string, which causes an attempted stack allocation with an attacker-controlled size (CVE-2014-9630).
References
- https://bugs.mageia.org/show_bug.cgi?id=15195
- http://lists.opensuse.org/opensuse-updates/2015-02/msg00015.html
- https://www.debian.org/security/2015/dsa-3150
- http://openwall.com/lists/oss-security/2015/01/20/11
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9625
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9626
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9627
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9628
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9629
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9630
SRPMS
4/tainted
- vlc-2.1.5-1.1.mga4.tainted
4/core
- vlc-2.1.5-1.1.mga4