oss-security - Re: CVE-Request FFmpeg vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 16 Sep 2013 21:05:46 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Reno Robert <renorobert@...il.com>, Michael Niedermayer <michaelni@....at>
Subject: Re: CVE-Request FFmpeg vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/14/2013 02:23 AM, Reno Robert wrote:
> Hi, Issues in libavcodec H.264 code of FFmpeg 0.11.3 leading to out
> of bound read/write. Below is the link to commit, used to fix the
> issue 
> http://git.videolan.org/?p=ffmpeg.git;a=commit;h=39ed5442620a7a0fd2328b7d4aefc6ae152c5441
>
>  I would like to request CVE Identifier for the above.

Please use CVE-2013-4358 for this issue.

Nifty, from the RFC:

   The H.264 specification
   includes two types of parameter sets: sequence parameter set and
   picture parameter set.  An active sequence parameter set remains
   unchanged throughout a coded video sequence, and an active picture
   parameter set remains unchanged within a coded picture.  The sequence
   and picture parameter set structures contain information such as
   picture size, optional coding modes employed, and macroblock to slice
   group map.

   To be able to change picture parameters (such as the picture size)
   without having to transmit parameter set updates synchronously to the
   slice packet stream, the encoder and decoder can maintain a list of
   more than one sequence and picture parameter set.  Each slice header
   contains a codeword that indicates the sequence and picture parameter
   set to be used.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)

iQIcBAEBAgAGBQJSN8cJAAoJEBYNRVNeJnmTHSIP/iZMuO76ctSfqZqv/4snYrRv
rZ56mvDgflGpl38C+kCu47dlShWdaSaWl5ne4TpzHtxF/DCnutA9YXv4V4eVpSM7
CSU27fxcMhKd9x9LNPAW2VWLYtyaa+JmPG5N8O0YdbzLOYEZRM59AKRZ72rFTc2U
OCmJWPi8u4WSLyfSBtFrT1s4YCSMarb+7u++VaTL+jzF7jPFnajlk3+Z+Ir2cCit
Mh+xSu0BNXMKQmkm9efChqQOYc1we+RFObTuls3oFySR9lTYKWvCUuRJ69mZhQuh
flXci52RrQmdD9t+0wXgv1OtkPidCPD+8Pr+Y3MM+1/0cOBGO916ckYs6kx2z6nv
qxlX1aufySwostZ1fVFJFxaPHbEkZ3hBlELSCcBhPFhXunDkR6QP2LOGDm3pBio8
2edM0gaCxVIcbV9D+24oZvxpF+AphrQgXvEAT0rjs33B3Q4ClnZOS95dXvp1/dRk
ymQLZDmMB1E7cXYa0nKZoR1Fd1X8E2UV5YKw7gWFaaxmEQ9HtXmnee+VI9I9Ndaw
MR/YinYvttROBCUj5nfQdlBlaEcjCXFqIoOax9g0Yynp2VPrQBxE0YBbUB2O37Ua
wt4ChysOI6/3m2+T//rIF2znv07fbsi7AdZ1sP5Qx5BxCrNpIFDvlD95+rkODTPo
7SWZw8hgyGSe+4FHBex4
=QDoo
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.