Advisories ยป MGASA-2015-0053

Updated vlc packages fix security vulnerabilities

Publication date: 05 Feb 2015
Modification date: 05 Feb 2015
Type: security
Affected Mageia releases : 4
CVE: CVE-2014-9625 , CVE-2014-9626 , CVE-2014-9627 , CVE-2014-9628 , CVE-2014-9629 , CVE-2014-9630

Description

Updated vlc packages fix security vulnerabilities:

On 32 bit builds, parsing of update status files with a size of 4294967295
or more lead to an integer truncation caused by a cast to size_t in a call to
malloc and a subsequent buffer overflow. This happened prior to checking the
files' signature (CVE-2014-9625).

The MP4 demuxer, when parsing string boxes, did not properly check the length
of the box, leading to a possible integer underflow when using this length
value in a call to memcpy(). This could allow remote attackers to cause a
denial of service (crash) or arbitrary code execution via crafted MP4 files
(CVE-2014-9626).

The MP4 demuxer, when parsing string boxes, did not properly check that the
conversion of the box length from 64bit integer to 32bit integer on 32bit
platforms did not cause a truncation, leading to a possible buffer overflow.
This could allow remote attackers to cause a denial of service (crash) or
arbitrary code execution via crafted MP4 files (CVE-2014-9627).

The MP4 demuxer, when parsing string boxes, did not properly check the length
of the box, leading to a possible buffer overflow. This could allow remote
attackers to cause a denial of service (crash) or arbitrary code execution
via crafted MP4 files (CVE-2014-9628).

The Dirac and Schroedinger encoders did not properly check for an integer
overflow on 32bit platforms, leading to a possible buffer overflow. This
could allow remote attackers to cause a denial of service (crash) or
arbitrary code execution (CVE-2014-9629).

When streaming ogg-files via rtp, an ogg-file can trigger an invalid memory
write access using an overly long 'configuration' string, which causes an
attempted stack allocation with an attacker-controlled size (CVE-2014-9630).

References

SRPMS

4/core

4/tainted