CVE-2023-24756: Null Pointer Dereference

Q: What is CVE-2023-24756?

CVE-2023-24756 is a vulnerability in libde265 v1.0.10 that allows attackers to cause a Denial of Service (DoS) via a crafted input file.

Q: What is the severity of CVE-2023-24756?

CVE-2023-24756 has a severity rating of medium with a CVSS score of 5.5.

Q: How does CVE-2023-24756 impact Struktur Libde265 v1.0.10?

CVE-2023-24756 impacts Struktur Libde265 v1.0.10 by allowing attackers to cause a Denial of Service (DoS) via a crafted input file.

Q: How does CVE-2023-24756 impact Debian Debian Linux 10.0?

CVE-2023-24756 impacts Debian Debian Linux 10.0 by allowing attackers to cause a Denial of Service (DoS) via a crafted input file.

Q: How do I fix CVE-2023-24756 in libde265 v1.0.10?

To fix CVE-2023-24756 in libde265 v1.0.10, it is recommended to update to the latest version of the software.

Q: Where can I find more information about CVE-2023-24756?

More information about CVE-2023-24756 can be found at the following references: [link1](https://github.com/strukturag/libde265/issues/380), [link2](https://lists.debian.org/debian-lts-announce/2023/03/msg00004.html).

Published Mar 1, 2023

Updated

libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ffhevcputunweightedpred8sse function at sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input file.

Affected Software

8 affected componentsFixes available

ubuntu/libde265<1.0.2-2ubuntu0.18.04.1~

1.0.2-2ubuntu0.18.04.1~

ubuntu/libde265<1.0.4-1ubuntu0.3

1.0.4-1ubuntu0.3

ubuntu/libde265<1.0.8-1ubuntu0.2

1.0.8-1ubuntu0.2

ubuntu/libde265<1.0.11-1

1.0.11-1

ubuntu/libde265<1.0.2-2ubuntu0.16.04.1~

1.0.2-2ubuntu0.16.04.1~

struktur libde265=1.0.10

Debian Debian Linux=10.0

debian/libde265

1.0.11-1+deb12u21.0.11-1+deb12u31.0.15-1+deb13u21.1.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.2-2ubuntu0.18.04.1~
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.4-1ubuntu0.3
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.8-1ubuntu0.2
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.11-1
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.2-2ubuntu0.16.04.1~
Upgrade
Upgrade debian/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.11-1+deb12u2Fixed in 1.0.11-1+deb12u3Fixed in 1.0.15-1+deb13u2Fixed in 1.1.3-1

Event History

Mar 1, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3352-1

Frequently Asked Questions

What is CVE-2023-24756?