CVE-2023-24752: Null Pointer Dereference

Q: What is CVE-2023-24752?

CVE-2023-24752 is a vulnerability in libde265 v1.0.10 that allows attackers to cause a Denial of Service (DoS) via a crafted input file.

Q: What is the severity of CVE-2023-24752?

CVE-2023-24752 has a severity rating of 5.5 (medium).

Q: How does CVE-2023-24752 affect the software?

CVE-2023-24752 affects libde265 v1.0.10 and Debian Debian Linux 10.0.

Q: How can I fix CVE-2023-24752?

To fix CVE-2023-24752, update to a version of libde265 that does not contain the vulnerability.

Q: Where can I find more information about CVE-2023-24752?

More information about CVE-2023-24752 can be found in the references provided: [link1], [link2].

Published Mar 1, 2023

Updated

libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ffhevcputhevcepelpixels8sse function at sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input file.

Affected Software

8 affected componentsFixes available

ubuntu/libde265<1.0.2-2ubuntu0.18.04.1~

1.0.2-2ubuntu0.18.04.1~

ubuntu/libde265<1.0.4-1ubuntu0.3

1.0.4-1ubuntu0.3

ubuntu/libde265<1.0.8-1ubuntu0.2

1.0.8-1ubuntu0.2

ubuntu/libde265<1.0.11-1

1.0.11-1

ubuntu/libde265<1.0.2-2ubuntu0.16.04.1~

1.0.2-2ubuntu0.16.04.1~

struktur libde265=1.0.10

Debian Debian Linux=10.0

debian/libde265

1.0.11-1+deb12u21.0.11-1+deb12u31.0.15-1+deb13u21.1.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.2-2ubuntu0.18.04.1~
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.4-1ubuntu0.3
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.8-1ubuntu0.2
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.11-1
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.2-2ubuntu0.16.04.1~
Upgrade
Upgrade debian/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.11-1+deb12u2Fixed in 1.0.11-1+deb12u3Fixed in 1.0.15-1+deb13u2Fixed in 1.1.3-1

Event History

Mar 1, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3352-1

Frequently Asked Questions

What is CVE-2023-24752?