The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6659-1 advisory.

    It was discovered that libde265 could be made to write out of bounds. If a user or automated system were     tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial     of service or execute arbitrary code. (CVE-2022-43244, CVE-2022-43249, CVE-2022-43250, CVE-2022-47665,     CVE-2023-25221)

    It was discovered that libde265 could be made to read out of bounds. If a user or automated system were     tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial     of service. (CVE-2022-43245)

    It was discovered that libde265 could be made to dereference invalid memory. If a user or automated system     were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a     denial of service. (CVE-2023-24751, CVE-2023-24752, CVE-2023-24754, CVE-2023-24755, CVE-2023-24756,     CVE-2023-24757, CVE-2023-24758)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3352 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3352-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     March 04, 2023                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libde265     Version        : 1.0.11-0+deb10u4     CVE ID         : CVE-2023-24751 CVE-2023-24752 CVE-2023-24754 CVE-2023-24755                      CVE-2023-24756 CVE-2023-24757 CVE-2023-24758 CVE-2023-25221     Debian Bug     :

    Multiple issues were found in libde265, an open source implementation of the     h.265 video codec, which may result in denial of service, possibly code     execution due to a heap-based buffer overflow or have unspecified other     impact.

    CVE-2023-24751

        libde265 v1.0.10 was discovered to contain a NULL pointer         dereference in the mc_chroma function at motion.cc. This         vulnerability allows attackers to cause a Denial of Service (DoS)         via a crafted input file.

    CVE-2023-24752

        libde265 v1.0.10 was discovered to contain a NULL pointer         dereference in the ff_hevc_put_hevc_epel_pixels_8_sse function at         sse-motion.cc. This vulnerability allows attackers to cause a Denial         of Service (DoS) via a crafted input file.

    CVE-2023-24754

        libde265 v1.0.10 was discovered to contain a NULL pointer         dereference in the ff_hevc_put_weighted_pred_avg_8_sse function at         sse-motion.cc. This vulnerability allows attackers to cause a Denial         of Service (DoS) via a crafted input file.

    CVE-2023-24755

        libde265 v1.0.10 was discovered to contain a NULL pointer         dereference in the put_weighted_pred_8_fallback function at         fallback-motion.cc. This vulnerability allows attackers to cause a         Denial of Service (DoS) via a crafted input file.

    CVE-2023-24756

        libde265 v1.0.10 was discovered to contain a NULL pointer         dereference in the ff_hevc_put_unweighted_pred_8_sse function at         sse-motion.cc. This vulnerability allows attackers to cause a Denial         of Service (DoS) via a crafted input file.

    CVE-2023-24757

        libde265 v1.0.10 was discovered to contain a NULL pointer         dereference in the put_unweighted_pred_16_fallback function at         fallback-motion.cc. This vulnerability allows attackers to cause a         Denial of Service (DoS) via a crafted input file.

    CVE-2023-24758

        libde265 v1.0.10 was discovered to contain a NULL pointer         dereference in the ff_hevc_put_weighted_pred_avg_8_sse function at         sse-motion.cc. This vulnerability allows attackers to cause a Denial         of Service (DoS) via a crafted input file.

    CVE-2023-25221

        Libde265 v1.0.10 was discovered to contain a heap-buffer-overflow         vulnerability in the derive_spatial_luma_vector_prediction function         in motion.cc.

    For Debian 10 buster, these problems have been fixed in version     1.0.11-0+deb10u4.

    We recommend that you upgrade your libde265 packages.

    For the detailed security status of libde265 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libde265

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202408-20 (libde265: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in libde265. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
191024	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : libde265 vulnerabilities (USN-6659-1)	Nessus	Ubuntu Local Security Checks	2/27/2024	8/27/2024	high
172109	Debian dla-3352 : libde265-0 - security update	Nessus	Debian Local Security Checks	3/5/2023	1/22/2025	high
205344	GLSA-202408-20 : libde265: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	8/10/2024	8/10/2024	critical

Detections

Analytics

Plugins Search

high

high

critical