LTS

This is my sixth month of working for LTS. I was assigned 12 hrs and worked all of them.

Released DLAs

1. DLA 2742-1 ffmpeg_7:3.2.15-0+deb9u3

   • CVE-2020-22036 : A heap-based Buffer Overflow vulnerability in filter_intra at libavfilter/vf_bwdif.c, which might lead to memory corruption and other potential consequences.
   • CVE-2020-22032 : A heap-based Buffer Overflow vulnerability in gaussian_blur, which might lead to memory corruption and other potential consequences.
   • CVE-2020-22031 : A Heap-based Buffer Overflow vulnerability in filter16_complex_low, which might lead to memory corruption and other potential consequences.
   • CVE-2020-22028 : Buffer Overflow vulnerability in filter_vertically_8 at libavfilter/vf_avgblur.c, which could cause a remote Denial of Service.
   • CVE-2020-22026 : Buffer Overflow vulnerability exists in the config_input function at libavfilter/af_tremolo.c, which could let a remote malicious user cause a Denial of Service.
   • CVE-2020-22025 : A heap-based Buffer Overflow vulnerability exists in gaussian_blur at libavfilter/vf_edgedetect.c, which might lead to memory corruption and other potential consequences.
   • CVE-2020-22023 : A heap-based Buffer Overflow vulnerabililty exists in filter_frame at libavfilter/vf_bitplanenoise.c, which might lead to memory corruption and other potential consequences.
   • CVE-2020-22022 : A heap-based Buffer Overflow vulnerability exists in filter_frame at libavfilter/vf_fieldorder.c, which might lead to memory corruption and other potential consequences.
   • CVE-2020-22021 : Buffer Overflow vulnerability at filter_edges function in libavfilter/vf_yadif.c, which could let a remote malicious user cause a Denial of Service.
   • CVE-2020-22020 : Buffer Overflow vulnerability in the build_diff_map function in libavfilter/vf_fieldmatch.c, which could let a remote malicious user cause a Denial of Service.
   • CVE-2020-22016 : A heap-based Buffer Overflow vulnerability at libavcodec/get_bits.h when writing .mov files, which might lead to memory corruption and other potential consequences.
   • CVE-2020-22015 : Buffer Overflow vulnerability in mov_write_video_tag due to the out of bounds in libavformat/movenc.c, which could let a remote malicious user obtain sensitive information, cause a Denial of Service, or execute arbitrary code.
   • CVE-2020-21041 : Buffer Overflow vulnerability exists via apng_do_inverse_blend in libavcodec/pngenc.c, which could let a remote malicious user cause a Denial of Service
   • CVE-2021-3566 : The tty demuxer did not have a ‘read_probe’ function assigned to it. By crafting a legitimate “ffconcat” file that references an image, followed by a file the triggers the tty demuxer, the contents of the second file will be copied into the output file verbatim (as long as the -vcodec copy option is passed to ffmpeg).
   • CVE-2021-38114 : libavcodec/dnxhddec.c does not check the return value of the init_vlc function. Crafted DNxHD data can cause unspecified impact.

2. DLA 2742-2 ffmpeg_7:3.2.15-0+deb9u4 During the backporting of one of patches in CVE-2020-22021 one line was wrongly interpreted and it caused the regression during the deinterlacing process. Thanks to Jari Ruusu for the reporting the issue and for the testing of prepared update.

Other LTS-related work

• Analyzed CVE-2020-22027 and marked as ignored for stretch. Original patch is not appliable. The issue is reproducible though.

• Analyzed CVE-2020-22019 and marked as ignored for stretch.

• Analyzed CVE-2020-22017 and marked as ignored for stretch.

• Updated tomcat8-LTS-salsa-repo to tne newer 8.5.54-0+deb9u7 version.

• Minor WIKI update.

• Frontdesk duties CW33/2021. It was my fist attempt to do such kind of task. I triaged apache2 and gitit.

• Analyzed CVEs in firmware-nonfree .

• Started to work on rustc .

LTS-Meeting

• I attended the Debian LTS team Jitsi-meeting (though the connection was extremely bad).
• Partly participated in preparation of Debconf21 BoF “Funding Projects to Improve Debian”.

Debian Science Team

• Partly participated in Debconf21 Debian Science BoF.

Other FLOSS activities

• Reviewed many merge requests in Yade open source project, merge some of them.

Značky: #Debian