Out-of-bounds write in Intel(R) Media SDK all versions and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3358-1 advisory.

    - Dropped support for libmfx to fix the following CVEs:
      * libmfx: improper input validation (CVE-2023-48368, bsc#1226897)
      * libmfx: improper buffer restrictions (CVE-2023-45221, bsc#1226898)
      * libmfx: out-of-bounds read (CVE-2023-22656, bsc#1226899)
      * libmfx: out-of-bounds write (CVE-2023-47282, bsc#1226900)
      * libmfx: improper buffer restrictions (CVE-2023-47169, bsc#1226901)
    - CVE-2024-7055: heap-based buffer overflow in pnmdec.c from the libavcodec library. (bsc#1229026)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3339-1 advisory.

    - CVE-2023-48368: Fixed an improper input validation. (bsc#1226897)
    - CVE-2023-45221: Fixed an improper buffer restrictions. (bsc#1226898)
    - CVE-2023-22656: Fixed an out-of-bounds read. (bsc#1226899)
    - CVE-2023-47282: Fixed an out-of-bounds write. (bsc#1226900)
    - CVE-2023-47169: Fixed an improper buffer restrictions. (bsc#1226901)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3309-1 advisory.

    - CVE-2023-48368: Fixed an improper input validation. (bsc#1226897)
    - CVE-2023-45221: Fixed an improper buffer restrictions. (bsc#1226898)
    - CVE-2023-22656: Fixed an out-of-bounds read. (bsc#1226899)
    - CVE-2023-47282: Fixed an out-of-bounds write. (bsc#1226900)
    - CVE-2023-47169: Fixed an improper buffer restrictions. (bsc#1226901)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3295-1 advisory.

    - Dropped support for libmfx to fix the following CVEs:
      * libmfx: improper input validation (CVE-2023-48368, bsc#1226897)
      * libmfx: improper buffer restrictions (CVE-2023-45221, bsc#1226898)
      * libmfx: out-of-bounds read (CVE-2023-22656, bsc#1226899)
      * libmfx: out-of-bounds write (CVE-2023-47282, bsc#1226900)
      * libmfx: improper buffer restrictions (CVE-2023-47169, bsc#1226901)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3289-1 advisory.

    - Dropped support for libmfx to fix the following CVEs:
      * libmfx: improper input validation (CVE-2023-48368, bsc#1226897)
      * libmfx: improper buffer restrictions (CVE-2023-45221, bsc#1226898)
      * libmfx: out-of-bounds read (CVE-2023-22656, bsc#1226899)
      * libmfx: out-of-bounds write (CVE-2023-47282, bsc#1226900)
      * libmfx: improper buffer restrictions (CVE-2023-47169, bsc#1226901)

    The libmfx dependency is replaced by libvpl.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3198-1 advisory.

    - Dropped support for libmfx to fix the following CVEs:
      * libmfx: improper input validation (CVE-2023-48368, bsc#1226897)
      * libmfx: improper buffer restrictions (CVE-2023-45221, bsc#1226898)
      * libmfx: out-of-bounds read (CVE-2023-22656, bsc#1226899)
      * libmfx: out-of-bounds write (CVE-2023-47282, bsc#1226900)
      * libmfx: improper buffer restrictions (CVE-2023-47169, bsc#1226901)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Intel Media SDK installed on the remote host is affected by multiple vulnerabilities:

  - Improper input validation in Intel Media SDK software all versions may allow an authenticated user to potentially     enable denial of service via local access. (CVE-2023-48368)

  - Improper buffer restrictions in Intel Media SDK all versions may allow an authenticated user to potentially enable     escalation of privilege via local access. (CVE-2023-45221)   
  - Out-of-bounds read in Intel Media SDK and some Intel oneVPL software before version 23.3.5 may allow an     authenticated user to potentially enable escalation of privilege via local access. (CVE-2023-22656)

  - Out-of-bounds write in Intel Media SDK all versions and some Intel oneVPL software before version 23.3.5 may allow     an authenticated user to potentially enable escalation of privilege via local access. (CVE-2023-47282)

  - Improper buffer restrictions in Intel Media SDK software all versions may allow an authenticated user to     potentially enable denial of service via local access. (CVE-2023-47169)

Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
207540	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : ffmpeg-4 (SUSE-SU-2024:3358-1)	Nessus	SuSE Local Security Checks	medium
207489	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libmfx (SUSE-SU-2024:3339-1)	Nessus	SuSE Local Security Checks	medium
207420	SUSE SLES12 Security Update : libmfx (SUSE-SU-2024:3309-1)	Nessus	SuSE Local Security Checks	medium
207418	SUSE SLES15 Security Update : gstreamer-plugins-bad (SUSE-SU-2024:3295-1)	Nessus	SuSE Local Security Checks	high
207379	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gstreamer-plugins-bad, libvpl (SUSE-SU-2024:3289-1)	Nessus	SuSE Local Security Checks	high
206966	SUSE SLES15 Security Update : gstreamer-plugins-bad (SUSE-SU-2024:3198-1)	Nessus	SuSE Local Security Checks	medium
197900	Intel Media SDK Multiple Vulnerabilities (INTEL-SA-00935)	Nessus	Misc.	medium

Detections

Analytics

CVE-2023-47282

low

Tenable Plugins

medium

medium

medium

high

high

medium

medium