Debian Long Term Support / LTS Security Information / 2016 / Security Information -- DLA-464-1 libav

Debian Security Advisory

DLA-464-1 libav -- LTS security update

Date Reported:

10 May 2016

Affected Packages:

libav

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2014-9676.

More information:

It was discovered that there was a use-after free vulnerability in libav, a multimedia player, server, encoder and transcoder library.

The seg_write_packet function in libavformat/segment.c in ffmpeg 2.1.4 and earlier does not free the correct memory location, which allows remote attackers to cause a denial of service ("invalid memory handler") and possibly execute arbitrary code via a crafted video that triggers a use after free.

For Debian 7 Wheezy, this issue has been fixed in libav version 6:0.8.17-2+deb7u1.

We recommend that you upgrade your libav packages.