Changelog
libav (6:11.6-1~deb8u1) jessie-security; urgency=medium
* New upstream release fixing multiple security issues.
- concat: disable by default (CVE-2016-1897, CVE-2016-1898)
- aac_parser: add required padding for GetBitContext buffer
- ac3_parser: add required padding for GetBitContext buffer
- imc: add required padding for GetBitContext buffer
- h263: Always check both dimensions
- opusdec: properly handle mismatching configurations in multichannel
streams
- mov: Correctly allocate ctts_data
- aac: Wait to know the channels before allocating frame
- rtpdec_asf: Check memory allocation and free memory on error
- jack: Check memory allocation
- mov: Check memory allocation
- mkv: Correctly report the latest packet had been flushed
- aic: Fix slice size computation for widths multiples of 32 macroblocks
- webp: Make sure enough bytes are available
- g726: Do not crash on user mistake
- bytestream2: set the reader to the end when reading more than available
- vp7: bound checking in vp7_decode_frame_header
- mux: Make sure that the data is actually written
- file: properly forward errors from file_read() and file_write()
- mmvideo: Make sure the rle does not write over the frame boundaries
- opus: Buffer the samples from the correct offset
- nut: Use the correct codec_tag when multiple are available
- truemotion2: Fix the buffer check
- mimic: Always return on failure
- msnwc_tcp: Correctly report failure
- rpza: Check the blocks left before processing one
- dvdsubdec: Validate the RLE offsets
- avi: Validate the stream-id for DV as well
- mov: Use the correct type for size
* debian/confflags: Force --disable-protocol=concat.
* debian/patches/CVE-2016-2326.patch: avformat/asfenc: Check pts.
(CVE-2016-2326)
-- Sebastian Ramacher <email address hidden> Wed, 02 Mar 2016 23:13:43 +0100
