Security update for ffmpeg SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2017:0958-1 Final 1 1 2017-04-07T09:00:09Z current 2017-04-07T09:00:09Z 2017-04-07T09:00:09Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ffmpeg This update for ffmpeg fixes the following issues: Security issue fixed: - CVE-2016-10190: remote code execution vulnerability [ 1 - libavformat/http.c ] (boo#1022920) Detailed ChangeLog: - 3.1.6: https://github.com/FFmpeg/FFmpeg/blob/e08b1cf2df8cfdb3394aa5ab0320739f8b5a1c4f/Changelog - 3.2.4: https://github.com/FFmpeg/FFmpeg/blob/cbe65ccfa02a9061cead73a6685eef90225c41b5/Changelog The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2017-449 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1022920 SUSE Bug 1022920 https://www.suse.com/security/cve/CVE-2016-10190/ SUSE CVE CVE-2016-10190 page SUSE Package Hub 12 SP1 SUSE Package Hub 12 SP2 ffmpeg-3.1.6-5.1 ffmpeg-devel-2.8.10-9.1 libavcodec-devel-3.1.6-5.1 libavcodec56-2.8.10-9.1 libavcodec57-3.1.6-5.1 libavdevice-devel-3.1.6-5.1 libavdevice56-2.8.10-9.1 libavdevice57-3.1.6-5.1 libavfilter-devel-3.1.6-5.1 libavfilter5-2.8.10-9.1 libavfilter6-3.1.6-5.1 libavformat-devel-3.1.6-5.1 libavformat56-2.8.10-9.1 libavformat57-3.1.6-5.1 libavresample-devel-3.1.6-5.1 libavresample2-2.8.10-9.1 libavresample3-3.1.6-5.1 libavutil-devel-3.1.6-5.1 libavutil54-2.8.10-9.1 libavutil55-3.1.6-5.1 libpostproc-devel-3.1.6-5.1 libpostproc53-2.8.10-9.1 libpostproc54-3.1.6-5.1 libswresample-devel-3.1.6-5.1 libswresample1-2.8.10-9.1 libswresample2-3.1.6-5.1 libswscale-devel-3.1.6-5.1 libswscale3-2.8.10-9.1 libswscale4-3.1.6-5.1 ffmpeg-3.1.6-5.1 as a component of SUSE Package Hub 12 SP1 ffmpeg-devel-2.8.10-9.1 as a component of SUSE Package Hub 12 SP1 libavcodec-devel-3.1.6-5.1 as a component of SUSE Package Hub 12 SP1 libavcodec56-2.8.10-9.1 as a component of SUSE Package Hub 12 SP1 libavcodec57-3.1.6-5.1 as a component of SUSE Package Hub 12 SP1 libavdevice-devel-3.1.6-5.1 as a component of SUSE Package Hub 12 SP1 libavdevice56-2.8.10-9.1 as a component of SUSE Package Hub 12 SP1 libavdevice57-3.1.6-5.1 as a component of SUSE Package Hub 12 SP1 libavfilter-devel-3.1.6-5.1 as a component of SUSE Package Hub 12 SP1 libavfilter5-2.8.10-9.1 as a component of SUSE Package Hub 12 SP1 libavfilter6-3.1.6-5.1 as a component of SUSE Package Hub 12 SP1 libavformat-devel-3.1.6-5.1 as a component of SUSE Package Hub 12 SP1 libavformat56-2.8.10-9.1 as a component of SUSE Package Hub 12 SP1 libavformat57-3.1.6-5.1 as a component of SUSE Package Hub 12 SP1 libavresample-devel-3.1.6-5.1 as a component of SUSE Package Hub 12 SP1 libavresample2-2.8.10-9.1 as a component of SUSE Package Hub 12 SP1 libavresample3-3.1.6-5.1 as a component of SUSE Package Hub 12 SP1 libavutil-devel-3.1.6-5.1 as a component of SUSE Package Hub 12 SP1 libavutil54-2.8.10-9.1 as a component of SUSE Package Hub 12 SP1 libavutil55-3.1.6-5.1 as a component of SUSE Package Hub 12 SP1 libpostproc-devel-3.1.6-5.1 as a component of SUSE Package Hub 12 SP1 libpostproc53-2.8.10-9.1 as a component of SUSE Package Hub 12 SP1 libpostproc54-3.1.6-5.1 as a component of SUSE Package Hub 12 SP1 libswresample-devel-3.1.6-5.1 as a component of SUSE Package Hub 12 SP1 libswresample1-2.8.10-9.1 as a component of SUSE Package Hub 12 SP1 libswresample2-3.1.6-5.1 as a component of SUSE Package Hub 12 SP1 libswscale-devel-3.1.6-5.1 as a component of SUSE Package Hub 12 SP1 libswscale3-2.8.10-9.1 as a component of SUSE Package Hub 12 SP1 libswscale4-3.1.6-5.1 as a component of SUSE Package Hub 12 SP1 ffmpeg-3.1.6-5.1 as a component of SUSE Package Hub 12 SP2 ffmpeg-devel-2.8.10-9.1 as a component of SUSE Package Hub 12 SP2 libavcodec-devel-3.1.6-5.1 as a component of SUSE Package Hub 12 SP2 libavcodec56-2.8.10-9.1 as a component of SUSE Package Hub 12 SP2 libavcodec57-3.1.6-5.1 as a component of SUSE Package Hub 12 SP2 libavdevice-devel-3.1.6-5.1 as a component of SUSE Package Hub 12 SP2 libavdevice56-2.8.10-9.1 as a component of SUSE Package Hub 12 SP2 libavdevice57-3.1.6-5.1 as a component of SUSE Package Hub 12 SP2 libavfilter-devel-3.1.6-5.1 as a component of SUSE Package Hub 12 SP2 libavfilter5-2.8.10-9.1 as a component of SUSE Package Hub 12 SP2 libavfilter6-3.1.6-5.1 as a component of SUSE Package Hub 12 SP2 libavformat-devel-3.1.6-5.1 as a component of SUSE Package Hub 12 SP2 libavformat56-2.8.10-9.1 as a component of SUSE Package Hub 12 SP2 libavformat57-3.1.6-5.1 as a component of SUSE Package Hub 12 SP2 libavresample-devel-3.1.6-5.1 as a component of SUSE Package Hub 12 SP2 libavresample2-2.8.10-9.1 as a component of SUSE Package Hub 12 SP2 libavresample3-3.1.6-5.1 as a component of SUSE Package Hub 12 SP2 libavutil-devel-3.1.6-5.1 as a component of SUSE Package Hub 12 SP2 libavutil54-2.8.10-9.1 as a component of SUSE Package Hub 12 SP2 libavutil55-3.1.6-5.1 as a component of SUSE Package Hub 12 SP2 libpostproc-devel-3.1.6-5.1 as a component of SUSE Package Hub 12 SP2 libpostproc53-2.8.10-9.1 as a component of SUSE Package Hub 12 SP2 libpostproc54-3.1.6-5.1 as a component of SUSE Package Hub 12 SP2 libswresample-devel-3.1.6-5.1 as a component of SUSE Package Hub 12 SP2 libswresample1-2.8.10-9.1 as a component of SUSE Package Hub 12 SP2 libswresample2-3.1.6-5.1 as a component of SUSE Package Hub 12 SP2 libswscale-devel-3.1.6-5.1 as a component of SUSE Package Hub 12 SP2 libswscale3-2.8.10-9.1 as a component of SUSE Package Hub 12 SP2 libswscale4-3.1.6-5.1 as a component of SUSE Package Hub 12 SP2 Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web servers to execute arbitrary code via a negative chunk size in an HTTP response. CVE-2016-10190 SUSE Package Hub 12 SP1:ffmpeg-3.1.6-5.1 SUSE Package Hub 12 SP1:ffmpeg-devel-2.8.10-9.1 SUSE Package Hub 12 SP1:libavcodec-devel-3.1.6-5.1 SUSE Package Hub 12 SP1:libavcodec56-2.8.10-9.1 SUSE Package Hub 12 SP1:libavcodec57-3.1.6-5.1 SUSE Package Hub 12 SP1:libavdevice-devel-3.1.6-5.1 SUSE Package Hub 12 SP1:libavdevice56-2.8.10-9.1 SUSE Package Hub 12 SP1:libavdevice57-3.1.6-5.1 SUSE Package Hub 12 SP1:libavfilter-devel-3.1.6-5.1 SUSE Package Hub 12 SP1:libavfilter5-2.8.10-9.1 SUSE Package Hub 12 SP1:libavfilter6-3.1.6-5.1 SUSE Package Hub 12 SP1:libavformat-devel-3.1.6-5.1 SUSE Package Hub 12 SP1:libavformat56-2.8.10-9.1 SUSE Package Hub 12 SP1:libavformat57-3.1.6-5.1 SUSE Package Hub 12 SP1:libavresample-devel-3.1.6-5.1 SUSE Package Hub 12 SP1:libavresample2-2.8.10-9.1 SUSE Package Hub 12 SP1:libavresample3-3.1.6-5.1 SUSE Package Hub 12 SP1:libavutil-devel-3.1.6-5.1 SUSE Package Hub 12 SP1:libavutil54-2.8.10-9.1 SUSE Package Hub 12 SP1:libavutil55-3.1.6-5.1 SUSE Package Hub 12 SP1:libpostproc-devel-3.1.6-5.1 SUSE Package Hub 12 SP1:libpostproc53-2.8.10-9.1 SUSE Package Hub 12 SP1:libpostproc54-3.1.6-5.1 SUSE Package Hub 12 SP1:libswresample-devel-3.1.6-5.1 SUSE Package Hub 12 SP1:libswresample1-2.8.10-9.1 SUSE Package Hub 12 SP1:libswresample2-3.1.6-5.1 SUSE Package Hub 12 SP1:libswscale-devel-3.1.6-5.1 SUSE Package Hub 12 SP1:libswscale3-2.8.10-9.1 SUSE Package Hub 12 SP1:libswscale4-3.1.6-5.1 SUSE Package Hub 12 SP2:ffmpeg-3.1.6-5.1 SUSE Package Hub 12 SP2:ffmpeg-devel-2.8.10-9.1 SUSE Package Hub 12 SP2:libavcodec-devel-3.1.6-5.1 SUSE Package Hub 12 SP2:libavcodec56-2.8.10-9.1 SUSE Package Hub 12 SP2:libavcodec57-3.1.6-5.1 SUSE Package Hub 12 SP2:libavdevice-devel-3.1.6-5.1 SUSE Package Hub 12 SP2:libavdevice56-2.8.10-9.1 SUSE Package Hub 12 SP2:libavdevice57-3.1.6-5.1 SUSE Package Hub 12 SP2:libavfilter-devel-3.1.6-5.1 SUSE Package Hub 12 SP2:libavfilter5-2.8.10-9.1 SUSE Package Hub 12 SP2:libavfilter6-3.1.6-5.1 SUSE Package Hub 12 SP2:libavformat-devel-3.1.6-5.1 SUSE Package Hub 12 SP2:libavformat56-2.8.10-9.1 SUSE Package Hub 12 SP2:libavformat57-3.1.6-5.1 SUSE Package Hub 12 SP2:libavresample-devel-3.1.6-5.1 SUSE Package Hub 12 SP2:libavresample2-2.8.10-9.1 SUSE Package Hub 12 SP2:libavresample3-3.1.6-5.1 SUSE Package Hub 12 SP2:libavutil-devel-3.1.6-5.1 SUSE Package Hub 12 SP2:libavutil54-2.8.10-9.1 SUSE Package Hub 12 SP2:libavutil55-3.1.6-5.1 SUSE Package Hub 12 SP2:libpostproc-devel-3.1.6-5.1 SUSE Package Hub 12 SP2:libpostproc53-2.8.10-9.1 SUSE Package Hub 12 SP2:libpostproc54-3.1.6-5.1 SUSE Package Hub 12 SP2:libswresample-devel-3.1.6-5.1 SUSE Package Hub 12 SP2:libswresample1-2.8.10-9.1 SUSE Package Hub 12 SP2:libswresample2-3.1.6-5.1 SUSE Package Hub 12 SP2:libswscale-devel-3.1.6-5.1 SUSE Package Hub 12 SP2:libswscale3-2.8.10-9.1 SUSE Package Hub 12 SP2:libswscale4-3.1.6-5.1 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-10190.html CVE-2016-10190 https://bugzilla.suse.com/1022920 SUSE Bug 1022920