CVE-2023-24754: Null Pointer Dereference

Q: What is CVE-2023-24754?

CVE-2023-24754 is a vulnerability in libde265 v1.0.10 that allows attackers to cause a denial of service (DoS) via a crafted input file.

Q: What is the severity of CVE-2023-24754?

The severity of CVE-2023-24754 is medium, with a severity value of 5.5.

Q: How does CVE-2023-24754 affect libde265?

CVE-2023-24754 affects libde265 v1.0.10, specifically the ff_hevc_put_weighted_pred_avg_8_sse function at sse-motion.cc.

Q: How can an attacker exploit CVE-2023-24754?

An attacker can exploit CVE-2023-24754 by providing a specially crafted input file.

Q: Is there a fix available for CVE-2023-24754?

Yes, a fix for CVE-2023-24754 is available. Please refer to the provided references for more information.

Published Mar 1, 2023

Updated

libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ffhevcputweightedpredavg8sse function at sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input file.

Affected Software

8 affected componentsFixes available

ubuntu/libde265<1.0.2-2ubuntu0.18.04.1~

1.0.2-2ubuntu0.18.04.1~

ubuntu/libde265<1.0.4-1ubuntu0.3

1.0.4-1ubuntu0.3

ubuntu/libde265<1.0.8-1ubuntu0.2

1.0.8-1ubuntu0.2

ubuntu/libde265<1.0.11-1

1.0.11-1

ubuntu/libde265<1.0.2-2ubuntu0.16.04.1~

1.0.2-2ubuntu0.16.04.1~

struktur libde265=1.0.10

Debian Debian Linux=10.0

debian/libde265

1.0.11-1+deb12u21.0.11-1+deb12u31.0.15-1+deb13u21.1.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.2-2ubuntu0.18.04.1~
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.4-1ubuntu0.3
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.8-1ubuntu0.2
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.11-1
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.2-2ubuntu0.16.04.1~
Upgrade
Upgrade debian/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.11-1+deb12u2Fixed in 1.0.11-1+deb12u3Fixed in 1.0.15-1+deb13u2Fixed in 1.1.3-1

Event History

Mar 1, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3352-1

Frequently Asked Questions

What is CVE-2023-24754?