The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6659-1 advisory.

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43244)

  - Libde265 v1.0.8 was discovered to contain a segmentation violation via apply_sao_internal<unsigned short>     in sao.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video     file. (CVE-2022-43245)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a     Denial of Service (DoS) via a crafted video file. (CVE-2022-43249)

  - Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via     put_qpel_0_0_fallback_16 in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of     Service (DoS) via a crafted video file. (CVE-2022-43250)

  - Libde265 1.0.9 has a heap buffer overflow vulnerability in de265_image::set_SliceAddrRS(int, int, int)     (CVE-2022-47665)

  - libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the mc_chroma function at     motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input     file. (CVE-2023-24751)

  - libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the     ff_hevc_put_hevc_epel_pixels_8_sse function at sse-motion.cc. This vulnerability allows attackers to cause     a Denial of Service (DoS) via a crafted input file. (CVE-2023-24752)

  - libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the     ff_hevc_put_weighted_pred_avg_8_sse function at sse-motion.cc. This vulnerability allows attackers to     cause a Denial of Service (DoS) via a crafted input file. (CVE-2023-24754, CVE-2023-24758)

  - libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put_weighted_pred_8_fallback     function at fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via     a crafted input file. (CVE-2023-24755)

  - libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the     ff_hevc_put_unweighted_pred_8_sse function at sse-motion.cc. This vulnerability allows attackers to cause     a Denial of Service (DoS) via a crafted input file. (CVE-2023-24756)

  - libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the     put_unweighted_pred_16_fallback function at fallback-motion.cc. This vulnerability allows attackers to     cause a Denial of Service (DoS) via a crafted input file. (CVE-2023-24757)

  - Libde265 v1.0.10 was discovered to contain a heap-buffer-overflow vulnerability in the     derive_spatial_luma_vector_prediction function in motion.cc. (CVE-2023-25221)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : libde265 vulnerabilities (USN-6659-1)

high Nessus Plugin ID 191024

Version 1.2