oss-sec mailing list archives
Re: CVE-Request FFmpeg vulnerability
From: Kurt Seifried <kseifried () redhat com>
Date: Mon, 16 Sep 2013 21:05:46 -0600
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 09/14/2013 02:23 AM, Reno Robert wrote:
Hi, Issues in libavcodec H.264 code of FFmpeg 0.11.3 leading to out of bound read/write. Below is the link to commit, used to fix the issue http://git.videolan.org/?p=ffmpeg.git;a=commit;h=39ed5442620a7a0fd2328b7d4aefc6ae152c5441 I would like to request CVE Identifier for the above.
Please use CVE-2013-4358 for this issue. Nifty, from the RFC: The H.264 specification includes two types of parameter sets: sequence parameter set and picture parameter set. An active sequence parameter set remains unchanged throughout a coded video sequence, and an active picture parameter set remains unchanged within a coded picture. The sequence and picture parameter set structures contain information such as picture size, optional coding modes employed, and macroblock to slice group map. To be able to change picture parameters (such as the picture size) without having to transmit parameter set updates synchronously to the slice packet stream, the encoder and decoder can maintain a list of more than one sequence and picture parameter set. Each slice header contains a codeword that indicates the sequence and picture parameter set to be used. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) iQIcBAEBAgAGBQJSN8cJAAoJEBYNRVNeJnmTHSIP/iZMuO76ctSfqZqv/4snYrRv rZ56mvDgflGpl38C+kCu47dlShWdaSaWl5ne4TpzHtxF/DCnutA9YXv4V4eVpSM7 CSU27fxcMhKd9x9LNPAW2VWLYtyaa+JmPG5N8O0YdbzLOYEZRM59AKRZ72rFTc2U OCmJWPi8u4WSLyfSBtFrT1s4YCSMarb+7u++VaTL+jzF7jPFnajlk3+Z+Ir2cCit Mh+xSu0BNXMKQmkm9efChqQOYc1we+RFObTuls3oFySR9lTYKWvCUuRJ69mZhQuh flXci52RrQmdD9t+0wXgv1OtkPidCPD+8Pr+Y3MM+1/0cOBGO916ckYs6kx2z6nv qxlX1aufySwostZ1fVFJFxaPHbEkZ3hBlELSCcBhPFhXunDkR6QP2LOGDm3pBio8 2edM0gaCxVIcbV9D+24oZvxpF+AphrQgXvEAT0rjs33B3Q4ClnZOS95dXvp1/dRk ymQLZDmMB1E7cXYa0nKZoR1Fd1X8E2UV5YKw7gWFaaxmEQ9HtXmnee+VI9I9Ndaw MR/YinYvttROBCUj5nfQdlBlaEcjCXFqIoOax9g0Yynp2VPrQBxE0YBbUB2O37Ua wt4ChysOI6/3m2+T//rIF2znv07fbsi7AdZ1sP5Qx5BxCrNpIFDvlD95+rkODTPo 7SWZw8hgyGSe+4FHBex4 =QDoo -----END PGP SIGNATURE-----
Current thread:
- CVE-Request FFmpeg vulnerability Reno Robert (Sep 16)
- Re: CVE-Request FFmpeg vulnerability Kurt Seifried (Sep 16)