CVE-2023-24751: Null Pointer Dereference

Q: What is CVE-2023-24751?

CVE-2023-24751 is a vulnerability in libde265 v1.0.10 that allows attackers to cause a Denial of Service (DoS) via a crafted input file.

Q: What is the severity of CVE-2023-24751?

CVE-2023-24751 has a severity of medium, with a severity value of 6.5.

Q: How does CVE-2023-24751 affect the software?

CVE-2023-24751 affects Struktur Libde265 v1.0.10 and Debian Debian Linux 10.0.

Q: How can I fix CVE-2023-24751?

To fix CVE-2023-24751, update your libde265 software to a version that does not contain the vulnerability.

Q: Where can I find more information about CVE-2023-24751?

You can find more information about CVE-2023-24751 in the GitHub issue and Debian LTS announcement provided in the references.

Published Mar 1, 2023

Updated

libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the mcchroma function at motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input file.

Affected Software

8 affected componentsFixes available

ubuntu/libde265<1.0.2-2ubuntu0.18.04.1~

1.0.2-2ubuntu0.18.04.1~

ubuntu/libde265<1.0.4-1ubuntu0.3

1.0.4-1ubuntu0.3

ubuntu/libde265<1.0.8-1ubuntu0.2

1.0.8-1ubuntu0.2

ubuntu/libde265<1.0.11-1

1.0.11-1

ubuntu/libde265<1.0.2-2ubuntu0.16.04.1~

1.0.2-2ubuntu0.16.04.1~

struktur libde265=1.0.10

Debian Debian Linux=10.0

debian/libde265

1.0.11-1+deb12u21.0.11-1+deb12u31.0.15-1+deb13u21.1.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.2-2ubuntu0.18.04.1~
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.4-1ubuntu0.3
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.8-1ubuntu0.2
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.11-1
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.2-2ubuntu0.16.04.1~
Upgrade
Upgrade debian/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.11-1+deb12u2Fixed in 1.0.11-1+deb12u3Fixed in 1.0.15-1+deb13u2Fixed in 1.1.3-1

Event History

Mar 1, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3352-1

Frequently Asked Questions

What is CVE-2023-24751?