diff options
Diffstat (limited to 'glsa-201406-28.xml')
| -rw-r--r-- | glsa-201406-28.xml | 83 |
1 files changed, 83 insertions, 0 deletions
diff --git a/glsa-201406-28.xml b/glsa-201406-28.xml new file mode 100644 index 00000000..012f8684 --- /dev/null +++ b/glsa-201406-28.xml @@ -0,0 +1,83 @@ +<?xml version="1.0" encoding="UTF-8"?> +<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?> +<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?> +<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> +<glsa id="201406-28"> + <title>Libav: Multiple vulnerabilities</title> + <synopsis>Multiple vulnerabilities have been found in Libav, allowing + attackers to execute arbitrary code or cause Denial of Service. + </synopsis> + <product type="ebuild">libav</product> + <announced>June 26, 2014</announced> + <revised>June 26, 2014: 1</revised> + <bug>439052</bug> + <bug>452202</bug> + <bug>470734</bug> + <access>remote</access> + <affected> + <package name="media-video/libav" auto="yes" arch="*"> + <unaffected range="ge">0.8.7</unaffected> + <vulnerable range="lt">0.8.7</vulnerable> + </package> + </affected> + <background> + <p>Libav is a complete solution to record, convert and stream audio and + video. + </p> + </background> + <description> + <p>Multiple vulnerabilities have been discovered in Libav. Please review + the CVE identifiers referenced below for details. + </p> + </description> + <impact type="normal"> + <p>A remote attacker could entice a user to open a specially crafted media + file in an application linked against Libav, possibly resulting in + execution of arbitrary code with the privileges of the application or a + Denial of Service condition. + </p> + </impact> + <workaround> + <p>There is no known workaround at this time.</p> + </workaround> + <resolution> + <p>All Libav users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=media-video/libav-0.8.7" + </code> + <p>Packages which depend on this library may need to be recompiled. Tools such + as revdep-rebuild may assist in identifying these packages. + </p> +</resolution> +<references> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2772">CVE-2012-2772</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2775">CVE-2012-2775</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2776">CVE-2012-2776</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2777">CVE-2012-2777</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2779">CVE-2012-2779</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2783">CVE-2012-2783</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2784">CVE-2012-2784</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2786">CVE-2012-2786</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2787">CVE-2012-2787</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2788">CVE-2012-2788</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2789">CVE-2012-2789</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2790">CVE-2012-2790</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2791">CVE-2012-2791</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2793">CVE-2012-2793</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2794">CVE-2012-2794</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2796">CVE-2012-2796</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2797">CVE-2012-2797</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2798">CVE-2012-2798</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2800">CVE-2012-2800</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2801">CVE-2012-2801</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2802">CVE-2012-2802</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2803">CVE-2012-2803</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2804">CVE-2012-2804</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5144">CVE-2012-5144</uri> +</references> +<metadata tag="requester" timestamp="Sat, 01 Dec 2012 19:41:59 +0000">ackle</metadata> +<metadata tag="submitter" timestamp="Thu, 26 Jun 2014 23:11:02 +0000">ackle</metadata> +</glsa> + |