Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusThis script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.SUSE_SU-2021-3521-1.NASL
HistoryOct 28, 2021 - 12:00 a.m.

SUSE SLED15 / SLES15 Security Update : ffmpeg (SUSE-SU-2021:3521-1)

2021-10-2800:00:00
This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
12

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.009 Low

EPSS

Percentile

82.5%

JSON

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3521-1 advisory.

  • Buffer Overflow vulnerability in function config_input in libavfilter/vf_gblur.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. (CVE-2020-20891)

  • An issue was discovered in function filter_frame in libavfilter/vf_lenscorrection.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts due to a division by zero.
    (CVE-2020-20892)

  • An issue was discovered in function latm_write_packet in libavformat/latmenc.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts due to a Null pointer dereference.
    (CVE-2020-20896)

  • A CWE-125: Out-of-bounds read vulnerability exists in long_term_filter function in g729postfilter.c in FFmpeg 4.2.1 during computation of the denominator of pseudo-normalized correlation R’(0), that could result in disclosure of information. (CVE-2020-20902)

  • A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in avcodec_alloc_context3 at options.c. (CVE-2020-22037)

  • decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations. (CVE-2020-35965)

  • Prior to ffmpeg version 4.3, the tty demuxer did not have a ‘read_probe’ function assigned to it. By crafting a legitimate ffconcat file that references an image, followed by a file the triggers the tty demuxer, the contents of the second file will be copied into the output file verbatim (as long as the -vcodec copy option is passed to ffmpeg). (CVE-2021-3566)

  • Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. (CVE-2021-38092)

  • Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. (CVE-2021-38093)

  • Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. (CVE-2021-38094)

Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.

#%NASL_MIN_LEVEL 70300
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# SUSE update advisory SUSE-SU-2021:3521-1. The text itself
# is copyright (C) SUSE.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(154620);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/07/13");

  script_cve_id(
    "CVE-2020-20891",
    "CVE-2020-20892",
    "CVE-2020-20895",
    "CVE-2020-20896",
    "CVE-2020-20899",
    "CVE-2020-20902",
    "CVE-2020-22037",
    "CVE-2020-35965",
    "CVE-2021-3566",
    "CVE-2021-38092",
    "CVE-2021-38093",
    "CVE-2021-38094"
  );
  script_xref(name:"SuSE", value:"SUSE-SU-2021:3521-1");

  script_name(english:"SUSE SLED15 / SLES15 Security Update : ffmpeg (SUSE-SU-2021:3521-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote SUSE host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as
referenced in the SUSE-SU-2021:3521-1 advisory.

  - Buffer Overflow vulnerability in function config_input in libavfilter/vf_gblur.c in Ffmpeg 4.2.1, allows
    attackers to cause a Denial of Service or other unspecified impacts. (CVE-2020-20891)

  - An issue was discovered in function filter_frame in libavfilter/vf_lenscorrection.c in Ffmpeg 4.2.1,
    allows attackers to cause a Denial of Service or other unspecified impacts due to a division by zero.
    (CVE-2020-20892)

  - An issue was discovered in function latm_write_packet in libavformat/latmenc.c in Ffmpeg 4.2.1, allows
    attackers to cause a Denial of Service or other unspecified impacts due to a Null pointer dereference.
    (CVE-2020-20896)

  - A CWE-125: Out-of-bounds read vulnerability exists in long_term_filter function in g729postfilter.c in
    FFmpeg 4.2.1 during computation of the denominator of pseudo-normalized correlation R'(0), that could
    result in disclosure of information. (CVE-2020-20902)

  - A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in avcodec_alloc_context3 at
    options.c. (CVE-2020-22037)

  - decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in
    calculations of when to perform memset zero operations. (CVE-2020-35965)

  - Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By
    crafting a legitimate ffconcat file that references an image, followed by a file the triggers the tty
    demuxer, the contents of the second file will be copied into the output file verbatim (as long as the
    `-vcodec copy` option is passed to ffmpeg). (CVE-2021-3566)

  - Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1,
    allows attackers to cause a Denial of Service or other unspecified impacts. (CVE-2021-38092)

  - Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1,
    allows attackers to cause a Denial of Service or other unspecified impacts. (CVE-2021-38093)

  - Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1,
    allows attackers to cause a Denial of Service or other unspecified impacts. (CVE-2021-38094)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1186756");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1187852");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1189166");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1190718");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1190719");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1190722");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1190723");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1190726");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1190729");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1190733");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1190734");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1190735");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-20891");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-20892");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-20895");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-20896");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-20899");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-20902");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-22037");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-35965");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-3566");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-38092");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-38093");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-38094");
  # https://lists.suse.com/pipermail/sle-security-updates/2021-October/009650.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4333c5b5");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-38094");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/01/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2021/10/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2021/10/28");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ffmpeg");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libavcodec-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libavcodec57");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libavdevice57");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libavfilter6");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libavformat-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libavformat57");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libavresample-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libavresample3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libavresample3-32bit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libavresample3-64bit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libavutil-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libavutil55");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpostproc-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpostproc54");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libswresample-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libswresample2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libswscale-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libswscale4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:15");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item("Host/SuSE/release");
if (isnull(os_release) || os_release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
var os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'SUSE');
os_ver = os_ver[1];
if (! preg(pattern:"^(SLED15|SLES15)$", string:os_ver)) audit(AUDIT_OS_NOT, 'SUSE SLED15 / SLES15', 'SUSE (' + os_ver + ')');

if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'SUSE (' + os_ver + ')', cpu);

var service_pack = get_kb_item("Host/SuSE/patchlevel");
if (isnull(service_pack)) service_pack = "0";
if (os_ver == "SLED15" && (! preg(pattern:"^(2|3)$", string:service_pack))) audit(AUDIT_OS_NOT, "SLED15 SP2/3", os_ver + " SP" + service_pack);
if (os_ver == "SLES15" && (! preg(pattern:"^(2|3)$", string:service_pack))) audit(AUDIT_OS_NOT, "SLES15 SP2/3", os_ver + " SP" + service_pack);

var pkgs = [
    {'reference':'libavcodec57-3.4.2-11.17.1', 'sp':'2', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libavcodec57-3.4.2-11.17.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libavformat57-3.4.2-11.17.1', 'sp':'2', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libavformat57-3.4.2-11.17.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libavresample-devel-3.4.2-11.17.1', 'sp':'2', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libavresample-devel-3.4.2-11.17.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libavresample3-3.4.2-11.17.1', 'sp':'2', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libavresample3-3.4.2-11.17.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libavresample3-32bit-3.4.2-11.17.1', 'sp':'2', 'cpu':'x86_64', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libavresample3-32bit-3.4.2-11.17.1', 'sp':'2', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libavutil-devel-3.4.2-11.17.1', 'sp':'2', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libavutil-devel-3.4.2-11.17.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libavutil55-3.4.2-11.17.1', 'sp':'2', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libavutil55-3.4.2-11.17.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libpostproc-devel-3.4.2-11.17.1', 'sp':'2', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libpostproc-devel-3.4.2-11.17.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libpostproc54-3.4.2-11.17.1', 'sp':'2', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libpostproc54-3.4.2-11.17.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libswresample-devel-3.4.2-11.17.1', 'sp':'2', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libswresample-devel-3.4.2-11.17.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libswresample2-3.4.2-11.17.1', 'sp':'2', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libswresample2-3.4.2-11.17.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libswscale-devel-3.4.2-11.17.1', 'sp':'2', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libswscale-devel-3.4.2-11.17.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libswscale4-3.4.2-11.17.1', 'sp':'2', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libswscale4-3.4.2-11.17.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.2']},
    {'reference':'libavcodec57-3.4.2-11.17.1', 'sp':'3', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libavcodec57-3.4.2-11.17.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libavformat57-3.4.2-11.17.1', 'sp':'3', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libavformat57-3.4.2-11.17.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libavresample-devel-3.4.2-11.17.1', 'sp':'3', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libavresample-devel-3.4.2-11.17.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libavresample3-3.4.2-11.17.1', 'sp':'3', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libavresample3-3.4.2-11.17.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libavresample3-64bit-3.4.2-11.17.1', 'sp':'3', 'cpu':'aarch64_ilp32', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libavresample3-64bit-3.4.2-11.17.1', 'sp':'3', 'cpu':'aarch64_ilp32', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libavutil-devel-3.4.2-11.17.1', 'sp':'3', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libavutil-devel-3.4.2-11.17.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libavutil55-3.4.2-11.17.1', 'sp':'3', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libavutil55-3.4.2-11.17.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libpostproc-devel-3.4.2-11.17.1', 'sp':'3', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libpostproc-devel-3.4.2-11.17.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libpostproc54-3.4.2-11.17.1', 'sp':'3', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libpostproc54-3.4.2-11.17.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libswresample-devel-3.4.2-11.17.1', 'sp':'3', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libswresample-devel-3.4.2-11.17.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libswresample2-3.4.2-11.17.1', 'sp':'3', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libswresample2-3.4.2-11.17.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libswscale-devel-3.4.2-11.17.1', 'sp':'3', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libswscale-devel-3.4.2-11.17.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libswscale4-3.4.2-11.17.1', 'sp':'3', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'libswscale4-3.4.2-11.17.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-desktop-applications-release-15.3']},
    {'reference':'ffmpeg-3.4.2-11.17.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-packagehub-subpackages-release-15.2']},
    {'reference':'libavdevice57-3.4.2-11.17.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-packagehub-subpackages-release-15.2']},
    {'reference':'libavfilter6-3.4.2-11.17.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-packagehub-subpackages-release-15.2']},
    {'reference':'ffmpeg-3.4.2-11.17.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-packagehub-subpackages-release-15.3']},
    {'reference':'libavdevice57-3.4.2-11.17.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-packagehub-subpackages-release-15.3']},
    {'reference':'libavfilter6-3.4.2-11.17.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-packagehub-subpackages-release-15.3']},
    {'reference':'libavcodec-devel-3.4.2-11.17.1', 'sp':'2', 'cpu':'x86_64', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-we-release-15.2']},
    {'reference':'libavcodec-devel-3.4.2-11.17.1', 'sp':'2', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-we-release-15.2']},
    {'reference':'libavformat-devel-3.4.2-11.17.1', 'sp':'2', 'cpu':'x86_64', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-we-release-15.2']},
    {'reference':'libavformat-devel-3.4.2-11.17.1', 'sp':'2', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-we-release-15.2']},
    {'reference':'libavresample-devel-3.4.2-11.17.1', 'sp':'2', 'cpu':'x86_64', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-we-release-15.2']},
    {'reference':'libavresample-devel-3.4.2-11.17.1', 'sp':'2', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-we-release-15.2']},
    {'reference':'libavresample3-3.4.2-11.17.1', 'sp':'2', 'cpu':'x86_64', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-we-release-15.2']},
    {'reference':'libavresample3-3.4.2-11.17.1', 'sp':'2', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-we-release-15.2']},
    {'reference':'libavcodec-devel-3.4.2-11.17.1', 'sp':'3', 'cpu':'x86_64', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-we-release-15.3']},
    {'reference':'libavcodec-devel-3.4.2-11.17.1', 'sp':'3', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-we-release-15.3']},
    {'reference':'libavformat-devel-3.4.2-11.17.1', 'sp':'3', 'cpu':'x86_64', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-we-release-15.3']},
    {'reference':'libavformat-devel-3.4.2-11.17.1', 'sp':'3', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-we-release-15.3']},
    {'reference':'libavresample-devel-3.4.2-11.17.1', 'sp':'3', 'cpu':'x86_64', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-we-release-15.3']},
    {'reference':'libavresample-devel-3.4.2-11.17.1', 'sp':'3', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-we-release-15.3']},
    {'reference':'libavresample3-3.4.2-11.17.1', 'sp':'3', 'cpu':'x86_64', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-we-release-15.3']},
    {'reference':'libavresample3-3.4.2-11.17.1', 'sp':'3', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-we-release-15.3']}
];

var ltss_caveat_required = FALSE;
var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var exists_check = NULL;
  var rpm_spec_vers_cmp = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (reference && _release) {
    if (exists_check) {
      var check_flag = 0;
      foreach var check (exists_check) {
        if (!rpm_exists(release:_release, rpm:check)) continue;
        check_flag++;
      }
      if (!check_flag) continue;
    }
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'ffmpeg / libavcodec-devel / libavcodec57 / libavdevice57 / etc');
}
VendorProductVersionCPE
novellsuse_linuxffmpegp-cpe:/a:novell:suse_linux:ffmpeg
novellsuse_linuxlibavcodec-develp-cpe:/a:novell:suse_linux:libavcodec-devel
novellsuse_linuxlibavcodec57p-cpe:/a:novell:suse_linux:libavcodec57
novellsuse_linuxlibavdevice57p-cpe:/a:novell:suse_linux:libavdevice57
novellsuse_linuxlibavfilter6p-cpe:/a:novell:suse_linux:libavfilter6
novellsuse_linuxlibavformat-develp-cpe:/a:novell:suse_linux:libavformat-devel
novellsuse_linuxlibavformat57p-cpe:/a:novell:suse_linux:libavformat57
novellsuse_linuxlibavresample-develp-cpe:/a:novell:suse_linux:libavresample-devel
novellsuse_linuxlibavresample3p-cpe:/a:novell:suse_linux:libavresample3
novellsuse_linuxlibavresample3-32bitp-cpe:/a:novell:suse_linux:libavresample3-32bit
Rows per page:
1-10 of 201

References

Related

suse 1
openvas 21
nessus 12
osv 22
nvd 12
prion 12
ubuntu 4
cnvd 5
cvelist 12
cve 12
ubuntucve 12
debiancve 10
veracode 3
alpinelinux 2
mageia 2
debian 5
gentoo 1
cloudfoundry 1
suse
suse
Security update for ffmpeg (moderate)
2021-10-26 00:00:00
openvas
openvas
openSUSE: Security Advisory for ffmpeg (openSUSE-SU-2021:3521-1)
2021-10-27 00:00:00
SUSE: Security Advisory (SUSE-SU-2021:3521-1)
2021-11-02 00:00:00
SUSE: Security Advisory (SUSE-SU-2023:0005-1)
2023-01-03 00:00:00
nessus
nessus
SUSE SLES15 Security Update : ffmpeg (SUSE-SU-2023:0005-1)
2023-01-03 00:00:00
openSUSE 15 Security Update : ffmpeg (openSUSE-SU-2021:3521-1)
2021-10-28 00:00:00
Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM : FFmpeg vulnerabilities (USN-6449-1)
2023-10-24 00:00:00
osv
osv
ffmpeg - security update
2022-05-16 00:00:00
ffmpeg - security update
2022-05-01 00:00:00
ffmpeg vulnerabilities
2023-10-24 10:26:27
nvd
nvd
CVE-2021-38092
2021-09-20 16:15:11
CVE-2020-20891
2021-09-20 16:15:08
CVE-2021-38093
2021-09-20 16:15:11
prion
prion
Integer overflow
2021-09-20 16:15:00
Integer overflow
2021-09-20 16:15:00
Buffer overflow
2021-09-20 16:15:00
ubuntu
ubuntu
FFmpeg regression
2023-11-15 00:00:00
FFmpeg vulnerabilities
2023-10-24 00:00:00
FFmpeg vulnerabilities
2022-06-13 00:00:00
cnvd
cnvd
FFmpeg integer overflow vulnerability (CNVD-2021-80287)
2021-09-23 00:00:00
FFmpeg integer overflow vulnerability (CNVD-2021-80290)
2021-09-23 00:00:00
FFmpeg integer overflow vulnerability (CNVD-2021-80289)
2021-09-23 00:00:00
cvelist
cvelist
CVE-2020-20899
2021-09-20 15:19:59
CVE-2020-20895
2021-09-20 15:19:58
CVE-2021-38093
2021-09-20 15:20:03
cve
cve
CVE-2020-20891
2021-09-20 16:15:08
CVE-2021-38094
2021-09-20 16:15:11
CVE-2021-38092
2021-09-20 16:15:11
ubuntucve
ubuntucve
CVE-2020-20896
2021-09-20 00:00:00
CVE-2020-20895
2021-09-20 00:00:00
CVE-2020-20899
2021-09-20 00:00:00
debiancve
debiancve
CVE-2021-38094
2021-09-20 16:15:11
CVE-2020-20902
2021-09-20 16:15:09
CVE-2021-38092
2021-09-20 16:15:11
veracode
veracode
Out-of-bounds Read
2022-05-30 00:32:05
Out-of-Bounds Access
2021-01-14 02:15:26
Denial Of Service (DoS)
2021-10-24 01:16:10
alpinelinux
alpinelinux
CVE-2020-35965
2021-01-04 02:15:11
CVE-2020-22037
2021-06-01 20:15:07
mageia
mageia
Updated ffmpeg packages fix a security vulnerability
2021-06-23 20:11:28
Updated ffmpeg packages fix security vulnerability
2021-10-29 22:32:22
debian
debian
[SECURITY] [DLA 2537-1] ffmpeg security update
2021-01-31 05:06:50
[SECURITY] [DSA 4998-1] ffmpeg security update
2021-10-31 16:40:22
[SECURITY] [DSA 4990-1] ffmpeg security update
2021-10-19 18:51:14
gentoo
gentoo
FFmpeg: Multiple vulnerabilities
2021-05-26 00:00:00
cloudfoundry
cloudfoundry
USN-5472-1: FFmpeg vulnerabilities | Cloud Foundry
2022-07-28 00:00:00

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.009 Low

EPSS

Percentile

82.5%

JSON
Related for SUSE_SU-2021-3521-1.NASL
suse1openvas21nessus12osv22nvd12prion12ubuntu4cnvd5cvelist12cve12ubuntucve12debiancve10veracode3alpinelinux2mageia2debian5gentoo1cloudfoundry1