The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3352 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3352-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     March 04, 2023                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libde265     Version        : 1.0.11-0+deb10u4     CVE ID         : CVE-2023-24751 CVE-2023-24752 CVE-2023-24754 CVE-2023-24755                      CVE-2023-24756 CVE-2023-24757 CVE-2023-24758 CVE-2023-25221     Debian Bug     :

    Multiple issues were found in libde265, an open source implementation of the     h.265 video codec, which may result in denial of service, possibly code     execution due to a heap-based buffer overflow or have unspecified other     impact.

    CVE-2023-24751

        libde265 v1.0.10 was discovered to contain a NULL pointer         dereference in the mc_chroma function at motion.cc. This         vulnerability allows attackers to cause a Denial of Service (DoS)         via a crafted input file.

    CVE-2023-24752

        libde265 v1.0.10 was discovered to contain a NULL pointer         dereference in the ff_hevc_put_hevc_epel_pixels_8_sse function at         sse-motion.cc. This vulnerability allows attackers to cause a Denial         of Service (DoS) via a crafted input file.

    CVE-2023-24754

        libde265 v1.0.10 was discovered to contain a NULL pointer         dereference in the ff_hevc_put_weighted_pred_avg_8_sse function at         sse-motion.cc. This vulnerability allows attackers to cause a Denial         of Service (DoS) via a crafted input file.

    CVE-2023-24755

        libde265 v1.0.10 was discovered to contain a NULL pointer         dereference in the put_weighted_pred_8_fallback function at         fallback-motion.cc. This vulnerability allows attackers to cause a         Denial of Service (DoS) via a crafted input file.

    CVE-2023-24756

        libde265 v1.0.10 was discovered to contain a NULL pointer         dereference in the ff_hevc_put_unweighted_pred_8_sse function at         sse-motion.cc. This vulnerability allows attackers to cause a Denial         of Service (DoS) via a crafted input file.

    CVE-2023-24757

        libde265 v1.0.10 was discovered to contain a NULL pointer         dereference in the put_unweighted_pred_16_fallback function at         fallback-motion.cc. This vulnerability allows attackers to cause a         Denial of Service (DoS) via a crafted input file.

    CVE-2023-24758

        libde265 v1.0.10 was discovered to contain a NULL pointer         dereference in the ff_hevc_put_weighted_pred_avg_8_sse function at         sse-motion.cc. This vulnerability allows attackers to cause a Denial         of Service (DoS) via a crafted input file.

    CVE-2023-25221

        Libde265 v1.0.10 was discovered to contain a heap-buffer-overflow         vulnerability in the derive_spatial_luma_vector_prediction function         in motion.cc.

    For Debian 10 buster, these problems have been fixed in version     1.0.11-0+deb10u4.

    We recommend that you upgrade your libde265 packages.

    For the detailed security status of libde265 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libde265

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3352 : libde265-0 - security update

high Nessus Plugin ID 172109

Version 1.6