CVE-2023-24757: Null Pointer Dereference

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2023-24757.

Q: What is the severity of CVE-2023-24757?

The severity of CVE-2023-24757 is medium.

Q: What is the affected software?

The affected software is Struktur Libde265 version 1.0.10 and Debian Debian Linux version 10.0.

Q: How can this vulnerability be exploited?

This vulnerability can be exploited by attackers using a crafted input file to cause a Denial of Service (DoS).

Q: Is there a fix available for CVE-2023-24757?

Yes, there is a fix available. Users should update to a version of libde265 that is not affected by the vulnerability.

Published Mar 1, 2023

Updated

libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the putunweightedpred16fallback function at fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input file.

Affected Software

8 affected componentsFixes available

ubuntu/libde265<1.0.2-2ubuntu0.18.04.1~

1.0.2-2ubuntu0.18.04.1~

ubuntu/libde265<1.0.4-1ubuntu0.3

1.0.4-1ubuntu0.3

ubuntu/libde265<1.0.8-1ubuntu0.2

1.0.8-1ubuntu0.2

ubuntu/libde265<1.0.11-1

1.0.11-1

ubuntu/libde265<1.0.2-2ubuntu0.16.04.1~

1.0.2-2ubuntu0.16.04.1~

struktur libde265=1.0.10

Debian Debian Linux=10.0

debian/libde265

1.0.11-1+deb12u21.0.11-1+deb12u31.0.15-1+deb13u21.1.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.2-2ubuntu0.18.04.1~
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.4-1ubuntu0.3
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.8-1ubuntu0.2
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.11-1
Upgrade
Upgrade ubuntu/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.2-2ubuntu0.16.04.1~
Upgrade
Upgrade debian/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.11-1+deb12u2Fixed in 1.0.11-1+deb12u3Fixed in 1.0.15-1+deb13u2Fixed in 1.1.3-1

Event History

Mar 1, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3352-1

Frequently Asked Questions

What is the vulnerability ID for this issue?