SUSE-SU-2018:3609-1: moderate: Security update for ffmpeg

[sle-updates at lists.suse.com]

   SUSE Security Update: Security update for ffmpeg
______________________________________________________________________________

Announcement ID:    SUSE-SU-2018:3609-1
Rating:             moderate
References:         #1097983 #1100345 #1100348 #1105869 
Cross-References:   CVE-2018-12458 CVE-2018-13300 CVE-2018-13305
                    CVE-2018-15822
Affected Products:
                    SUSE Linux Enterprise Workstation Extension 15
                    SUSE Linux Enterprise Module for Packagehub Subpackages 15
                    SUSE Linux Enterprise Module for Open Buildservice Development Tools 15
                    SUSE Linux Enterprise Module for Desktop Applications 15
______________________________________________________________________________

   An update that fixes four vulnerabilities is now available.

Description:

   This update for ffmpeg fixes the following issues:

   - CVE-2018-13300: An improper argument passed to the avpriv_request_sample
     function may have triggered an out-of-array read while converting a
     crafted AVI file to MPEG4, leading to a denial of service and possibly
     an information disclosure (bsc#1100348)
   - CVE-2018-15822: The flv_write_packet function did not check for an empty
     audio packet, leading to an assertion failure and DoS (bsc#1105869)
   - CVE-2018-13305: Due to a missing check for negative values of the mquant
     variable, the vc1_put_blocks_clamped function in libavcodec/vc1_block.c
     may trigger an out-of-array access while converting a crafted AVI file
     to MPEG4, leading to an information disclosure or a denial of service.
     (bsc#1100345).
   - CVE-2018-12458: An improper integer type in the mpeg4_encode_gop_header
     function in libavcodec/mpeg4videoenc.c might have triggered an assertion
     violation while converting a crafted AVI file to MPEG4, leading to a
     denial of service. (bsc#1097983).


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Workstation Extension 15:

      zypper in -t patch SUSE-SLE-Product-WE-15-2018-2566=1

   - SUSE Linux Enterprise Module for Packagehub Subpackages 15:

      zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-2018-2566=1

   - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15:

      zypper in -t patch SUSE-SLE-Module-Development-Tools-OBS-15-2018-2566=1

   - SUSE Linux Enterprise Module for Desktop Applications 15:

      zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-2018-2566=1



Package List:

   - SUSE Linux Enterprise Workstation Extension 15 (x86_64):

      ffmpeg-debuginfo-3.4.2-4.12.4
      ffmpeg-debugsource-3.4.2-4.12.4
      libavcodec-devel-3.4.2-4.12.4
      libavformat-devel-3.4.2-4.12.4
      libavformat57-3.4.2-4.12.4
      libavformat57-debuginfo-3.4.2-4.12.4
      libavresample-devel-3.4.2-4.12.4
      libavresample3-3.4.2-4.12.4
      libavresample3-debuginfo-3.4.2-4.12.4

   - SUSE Linux Enterprise Module for Packagehub Subpackages 15 (aarch64 ppc64le s390x x86_64):

      ffmpeg-3.4.2-4.12.4
      ffmpeg-debuginfo-3.4.2-4.12.4
      ffmpeg-debugsource-3.4.2-4.12.4
      libavdevice57-3.4.2-4.12.4
      libavdevice57-debuginfo-3.4.2-4.12.4
      libavfilter6-3.4.2-4.12.4
      libavfilter6-debuginfo-3.4.2-4.12.4

   - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (aarch64 ppc64le s390x x86_64):

      ffmpeg-3.4.2-4.12.4
      ffmpeg-debuginfo-3.4.2-4.12.4
      ffmpeg-debugsource-3.4.2-4.12.4
      ffmpeg-private-devel-3.4.2-4.12.4
      libavdevice-devel-3.4.2-4.12.4
      libavdevice57-3.4.2-4.12.4
      libavdevice57-debuginfo-3.4.2-4.12.4
      libavfilter-devel-3.4.2-4.12.4
      libavfilter6-3.4.2-4.12.4
      libavfilter6-debuginfo-3.4.2-4.12.4

   - SUSE Linux Enterprise Module for Desktop Applications 15 (aarch64 ppc64le s390x x86_64):

      ffmpeg-debuginfo-3.4.2-4.12.4
      ffmpeg-debugsource-3.4.2-4.12.4
      libavcodec57-3.4.2-4.12.4
      libavcodec57-debuginfo-3.4.2-4.12.4
      libavutil-devel-3.4.2-4.12.4
      libavutil55-3.4.2-4.12.4
      libavutil55-debuginfo-3.4.2-4.12.4
      libpostproc-devel-3.4.2-4.12.4
      libpostproc54-3.4.2-4.12.4
      libpostproc54-debuginfo-3.4.2-4.12.4
      libswresample-devel-3.4.2-4.12.4
      libswresample2-3.4.2-4.12.4
      libswresample2-debuginfo-3.4.2-4.12.4
      libswscale-devel-3.4.2-4.12.4
      libswscale4-3.4.2-4.12.4
      libswscale4-debuginfo-3.4.2-4.12.4


References:

   https://www.suse.com/security/cve/CVE-2018-12458.html
   https://www.suse.com/security/cve/CVE-2018-13300.html
   https://www.suse.com/security/cve/CVE-2018-13305.html
   https://www.suse.com/security/cve/CVE-2018-15822.html
   https://bugzilla.suse.com/1097983
   https://bugzilla.suse.com/1100345
   https://bugzilla.suse.com/1100348
   https://bugzilla.suse.com/1105869