Your message dated Fri, 21 Feb 2025 12:00:55 +0000
with message-id <e1tlrib-002cxw...@fasolo.debian.org>
and subject line Bug#1098470: fixed in openh264 2.6.0+dfsg-1
has caused the Debian Bug report #1098470,
regarding openh264: CVE-2025-27091: OpenH264 Decoding Functions Heap Overflow
Vulnerability
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
1098470: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098470
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: openh264
Version: 2.5.0+dfsg-1
Severity: grave
Tags: upstream security
Justification: user security hole
X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi,
The following vulnerability was published for openh264.
CVE-2025-27091[0]:
| OpenH264 is a free license codec library which supports H.264
| encoding and decoding. A vulnerability in the decoding functions of
| OpenH264 codec library could allow a remote, unauthenticated
| attacker to trigger a heap overflow. This vulnerability is due to a
| race condition between a Sequence Parameter Set (SPS) memory
| allocation and a subsequent non Instantaneous Decoder Refresh (non-
| IDR) Network Abstraction Layer (NAL) unit memory usage. An attacker
| could exploit this vulnerability by crafting a malicious bitstream
| and tricking a victim user into processing an arbitrary video
| containing the malicious bistream. An exploit could allow the
| attacker to cause an unexpected crash in the victim's user decoding
| client and, possibly, perform arbitrary commands on the victim's
| host by abusing the heap overflow. This vulnerability affects
| OpenH264 2.5.0 and earlier releases. Both Scalable Video Coding
| (SVC) mode and Advanced Video Coding (AVC) mode are affected by this
| vulnerability. OpenH264 software releases 2.6.0 and later contained
| the fix for this vulnerability. Users are advised to upgrade. There
| are no known workarounds for this vulnerability. ### For more
| information If you have any questions or comments about this
| advisory: * [Open an issue in
| cisco/openh264](https://github.com/cisco/openh264/issues) * Email
| Cisco Open Source Security ([oss-secur...@cisco.com](mailto:oss-
| secur...@cisco.com)) and Cisco PSIRT
| ([ps...@cisco.com](mailto:ps...@cisco.com)) ### Credits: *
| **Research:** Octavian Guzu and Andrew Calvano of Meta * **Fix
| ideation:** Philipp Hancke and Shyam Sadhwani of Meta * **Fix
| implementation:** Benzheng Zhang (@BenzhengZhang) * **Release
| engineering:** Benzheng Zhang (@BenzhengZhang)
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2025-27091
https://www.cve.org/CVERecord?id=CVE-2025-27091
[1] https://github.com/cisco/openh264/security/advisories/GHSA-m99q-5j7x-7m9x
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: openh264
Source-Version: 2.6.0+dfsg-1
Done: Bastian Germann <b...@debian.org>
We believe that the bug you reported is fixed in the latest version of
openh264, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1098...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Bastian Germann <b...@debian.org> (supplier of updated openh264 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 21 Feb 2025 08:30:38 +0100
Source: openh264
Binary: libopenh264-8 libopenh264-8-dbgsym libopenh264-cisco8 libopenh264-dev
Architecture: source i386
Version: 2.6.0+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Multimedia Maintainers <debian-multime...@lists.debian.org>
Changed-By: Bastian Germann <b...@debian.org>
Description:
libopenh264-8 - OpenH264 Video Codec
libopenh264-cisco8 - OpenH264 Video Codec provided by Cisco Systems, Inc.
libopenh264-dev - OpenH264 Video Codec - development files
Closes: 1098470
Changes:
openh264 (2.6.0+dfsg-1) unstable; urgency=medium
.
* New upstream version 2.6.0+dfsg (Closes: #1098470, CVE-2025-27091)
* Fix SHA256 checksums for 2.6.0
* Rename binary pkgs because of SO bump
Checksums-Sha1:
61e444e25f0ed75926f5f4834eb5c78bd5ec100b 1970 openh264_2.6.0+dfsg-1.dsc
4541f8dacc9c1561a662fb046840d751b944ed45 905728 openh264_2.6.0+dfsg.orig.tar.xz
239ec5ecdf13a9a84c44dcacfa176f18f60d22f0 8076
openh264_2.6.0+dfsg-1.debian.tar.xz
90e1d70bdb68921adda95e49d4964655e8b7257e 1022136
libopenh264-8-dbgsym_2.6.0+dfsg-1_i386.deb
00978b780335daa0e3108466773b524e6bd2e820 405768
libopenh264-8_2.6.0+dfsg-1_i386.deb
b60a3916bb54d9b4f5d4cf3d4f24608e55ad7883 10496
libopenh264-cisco8_2.6.0+dfsg-1_i386.deb
9a75423f1ea43b8843dc9e73e89994be59c25d4f 453324
libopenh264-dev_2.6.0+dfsg-1_i386.deb
4956862088d6f92f49a8b154ef972c283570c36e 6237
openh264_2.6.0+dfsg-1_i386.buildinfo
Checksums-Sha256:
f9cfbb00dd7f2db62efb6d2ca48fe41f8c81b900c0e0c01e38393133d5bb3a8a 1970
openh264_2.6.0+dfsg-1.dsc
52fc65775e03abe70f3f453c3c57fa7b31c71fe240de84da53d75f2ddc7dd519 905728
openh264_2.6.0+dfsg.orig.tar.xz
9ca9bdc0150c3e25042cca55cd0b47eaec4b03d0cbe895c3a55a09f1720b9c3a 8076
openh264_2.6.0+dfsg-1.debian.tar.xz
1c25b71da3d69b6dedc845353dcdfa461ed86fb1f70a287a12b8d23dacb1ff87 1022136
libopenh264-8-dbgsym_2.6.0+dfsg-1_i386.deb
2dc816dbb67823eee995ffab51ed4be421e17c6fddfcd62632fd571178dbd0ea 405768
libopenh264-8_2.6.0+dfsg-1_i386.deb
e577cdacb52fa8552e60a0994915d45e6bfa8b48ecad5d5d8e00eaddffa39d16 10496
libopenh264-cisco8_2.6.0+dfsg-1_i386.deb
1f02f60539deedadf79e09c0a69133d168fcd209e59d8350e5966044308d208c 453324
libopenh264-dev_2.6.0+dfsg-1_i386.deb
474a8f3f34dfdfb24793328612ad38a19e46248a17cb66cdd0815d1b60f258b6 6237
openh264_2.6.0+dfsg-1_i386.buildinfo
Files:
094717ff12848b1c4f52bc613d45d6a5 1970 libs optional openh264_2.6.0+dfsg-1.dsc
11b16b886e0a8a4636bfb27258981d63 905728 libs optional
openh264_2.6.0+dfsg.orig.tar.xz
79619e860b78047659ee67a030951442 8076 libs optional
openh264_2.6.0+dfsg-1.debian.tar.xz
0034f246f265926be0ca121fcf162f5e 1022136 debug optional
libopenh264-8-dbgsym_2.6.0+dfsg-1_i386.deb
ad1a7c6d5f0c1ddf3563da08c9150356 405768 libs optional
libopenh264-8_2.6.0+dfsg-1_i386.deb
0739ea00dbd7a4fc93f43cd595d934a0 10496 contrib/libs optional
libopenh264-cisco8_2.6.0+dfsg-1_i386.deb
801d8855a44b8e1dcdd781db07fe167a 453324 libdevel optional
libopenh264-dev_2.6.0+dfsg-1_i386.deb
43d0ba24bb5e2bc7fd426e35f2cb9fcc 6237 libs optional
openh264_2.6.0+dfsg-1_i386.buildinfo
-----BEGIN PGP SIGNATURE-----
iQHEBAEBCgAuFiEEQGIgyLhVKAI3jM5BH1x6i0VWQxQFAme4WgAQHGJhZ2VAZGVi
aWFuLm9yZwAKCRAfXHqLRVZDFAUwC/9QR1FebgMD0+4pOqsyVkSFie9MuU4ziEFb
ueEVF61L2CCJOUlP3sHFyo/vFqtOIGmcP+g7MP92+M/eX/PUsagQUoQoCVdfBXaZ
eQL5SpC+wk27ypr/BgSKaGDX30zY4zrUMzxiB3bcs/NNKnVvdAhCT/LWeZ6vgOy9
u7u9QQrpRCBjq1oNZOZJSdSsEVixHcjCqHKv7bON55lvfKBjB6v5SuhXgmnB6ub4
66ziUBdpAtykKPYsgtulr3QMIpghsR7EUh2wqo2IVU4lCXoSB3Ut/x7lBi5aqEeC
mxxHyWFGAz0GF8mgJPGjrnpteuaj5pqBBkLAMS6nHuoHYcZm6D3jN1KOsvMvgBoz
2MBvE8ZKo2gsUpBrxGDxl7tPBAWrmRIuZtj5MpORQJWMyXbFQ930DgZ9hZnoiOyq
TpviCl5OgN5W+S87sFLb/1Bxgw9f7/5cmHTbMY3QOeg14IMOvGOiLJmzhhU1JmA7
fMz39OOQYf0YoONl8VhC3iASaEywnK0=
=IVRe
-----END PGP SIGNATURE-----
pgp61WS0wetOO.pgp
Description: PGP signature
--- End Message ---
