<div dir="ltr"><br><br><div class="gmail_quote"><div dir="ltr">On Mon, Jun 12, 2017 at 12:06 PM Moritz Muehlenhoff <<a href="mailto:jmm@debian.org">jmm@debian.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Source: libquicktime<br>
Severity: grave<br>
Tags: security<br>
<br>
Please see:<br>
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9122" rel="noreferrer" target="_blank">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9122</a><br>
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9123" rel="noreferrer" target="_blank">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9123</a><br>
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9124" rel="noreferrer" target="_blank">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9124</a><br>
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9125" rel="noreferrer" target="_blank">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9125</a><br>
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9126" rel="noreferrer" target="_blank">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9126</a><br>
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9127" rel="noreferrer" target="_blank">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9127</a><br>
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9128" rel="noreferrer" target="_blank">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9128</a><br><br></blockquote><div><br></div><div>I've just uploaded a patch that should fix this. See <a href="https://anonscm.debian.org/cgit/pkg-multimedia/libquicktime.git/commit/?id=4728e38f2045d3d33be3d442a0ab9801990b4339">https://anonscm.debian.org/cgit/pkg-multimedia/libquicktime.git/commit/?id=4728e38f2045d3d33be3d442a0ab9801990b4339</a></div><div><br></div><div>This is how I tested it:</div><div><div>reproducible with qtinfo:</div><div><br></div><div>vagrant@stretch:/tmp/42148$ ls -al</div><div>total 48</div><div>drwxr-xr-x 2 vagrant vagrant 4096 Jun 9 16:41 .</div><div>drwxrwxrwt 11 root root 4096 Jun 30 20:27 ..</div><div>-rw-r--r-- 1 vagrant vagrant 6148 Jun 7 09:00 .DS_Store</div><div>-rw------- 1 vagrant vagrant 1967 May 17 03:52 libquicktime_1.2.4_lqt_frame_duration_heap-buffer-overflow.mp4</div><div>-rw------- 1 vagrant vagrant 1987 May 17 03:11 libquicktime_1.2.4_lqt_frame_duration_invalid_memory_read.mp4</div><div>-rw------- 1 vagrant vagrant 6841 May 17 03:11 libquicktime_1.2.4_quicktime_match_32_NULL_pointer_dereference.mp4</div><div>-rw------- 1 vagrant vagrant 1338 May 17 07:13 libquicktime_1.2.4_quicktime_read_dref_table_heap-buffer-overflow.mp4</div><div>-rw-r--r-- 1 vagrant vagrant 1259 Dec 16 2014 libquicktime_1.2.4_quicktime_read_moov_infinite_loop.mp4</div><div>-rw------- 1 vagrant vagrant 1294 May 17 02:42 libquicktime_1.2.4_quicktime_user_atoms_read_atom_heap-buffer-overflow.mp4</div><div>-rw------- 1 vagrant vagrant 1192 May 18 04:53 libquicktime_1.2.4_quicktime_video_width_heap-buffer-overflow.mp4</div><div>vagrant@stretch:/tmp/42148$ qtinfo *.mp4</div><div>Type: MP4</div><div> 0 audio tracks.</div><div> 1 video tracks.</div><div> 48x144, depth 24</div><div> rate 0.000369 [12:32541] not constant</div><div> length 0 frames</div><div> compressor avc1.</div><div> Native colormodel: Undefined</div><div> Interlace mode: None (Progressive)</div><div> No timecodes available</div><div> supported.</div><div> 0 text tracks.</div><div>Type: MP4</div><div> 0 audio tracks.</div><div> 1 video tracks.</div><div>Segmentation fault</div><div>vagrant@stretch:/tmp/42148$ qtinfo libquicktime_1.2.4_lqt_frame_duration_heap-buffer-overflow.mp4</div><div>Type: MP4</div><div> 0 audio tracks.</div><div> 1 video tracks.</div><div> 48x144, depth 24</div><div> rate 0.000367 [12:32660] not constant</div><div> length 0 frames</div><div> compressor avc1.</div><div> Native colormodel: Undefined</div><div> Interlace mode: None (Progressive)</div><div> No timecodes available</div><div> supported.</div><div> 0 text tracks.</div><div>vagrant@stretch:/tmp/42148$ qtinfo libquicktime_1.2.4_lqt_frame_duration_invalid_memory_read.mp4</div><div>Type: MP4</div><div> 0 audio tracks.</div><div> 1 video tracks.</div><div>Segmentation fault</div><div>vagrant@stretch:/tmp/42148$ qtinfo libquicktime_1.2.4_quicktime_match_32_NULL_pointer_dereference.mp4</div><div>Segmentation fault</div><div>vagrant@stretch:/tmp/42148$ qtinfo libquicktime_1.2.4_quicktime_read_dref_table_heap-buffer-overflow.mp4</div><div>Segmentation fault</div><div>vagrant@stretch:/tmp/42148$ qtinfo libquicktime_1.2.4_quicktime_read_moov_infinite_loop.mp4</div><div>^C</div><div><just hangs, I had to abort it></div><div>vagrant@stretch:/tmp/42148$ qtinfo libquicktime_1.2.4_quicktime_user_atoms_read_atom_heap-buffer-overflow.mp4</div><div>[ffmpeg_video] Error: No avcC atom present, decoding is likely to fail</div><div>Type: MP4</div><div> 0 audio tracks.</div><div> 1 video tracks.</div><div>Segmentation fault</div><div>vagrant@stretch:/tmp/42148$ qtinfo libquicktime_1.2.4_quicktime_video_width_heap-buffer-overflow.mp4</div><div>[codecs] Warning: Could not find video Decoder for fourcc </div><div>[codecs] Warning: quicktime_decode_video_stub called</div><div>Type: MP4</div><div> 0 audio tracks.</div><div> 1 video tracks.</div><div>Segmentation fault</div><div><br></div><div><br></div><div>With the patch applied: </div><div><br></div><div>vagrant@stretch:/tmp/42148$ for i in *.mp4; do echo $i; qtinfo $i; echo ----; done</div><div>libquicktime_1.2.4_lqt_frame_duration_heap-buffer-overflow.mp4</div><div>[core] Error: Opening failed (unsupported filetype)</div><div>Couldn't open libquicktime_1.2.4_lqt_frame_duration_heap-buffer-overflow.mp4</div><div>----</div><div>libquicktime_1.2.4_lqt_frame_duration_invalid_memory_read.mp4</div><div>[core] Error: Opening failed (unsupported filetype)</div><div>Couldn't open libquicktime_1.2.4_lqt_frame_duration_invalid_memory_read.mp4</div><div>----</div><div>libquicktime_1.2.4_quicktime_match_32_NULL_pointer_dereference.mp4</div><div>[core] Error: Opening failed (unsupported filetype)</div><div>Couldn't open libquicktime_1.2.4_quicktime_match_32_NULL_pointer_dereference.mp4</div><div>----</div><div>libquicktime_1.2.4_quicktime_read_dref_table_heap-buffer-overflow.mp4</div><div>[core] Error: Opening failed (unsupported filetype)</div><div>Couldn't open libquicktime_1.2.4_quicktime_read_dref_table_heap-buffer-overflow.mp4</div><div>----</div><div>libquicktime_1.2.4_quicktime_read_moov_infinite_loop.mp4</div><div>[core] Error: Opening failed (unsupported filetype)</div><div>Couldn't open libquicktime_1.2.4_quicktime_read_moov_infinite_loop.mp4</div><div>----</div><div>libquicktime_1.2.4_quicktime_user_atoms_read_atom_heap-buffer-overflow.mp4</div><div>[core] Error: Opening failed (unsupported filetype)</div><div>Couldn't open libquicktime_1.2.4_quicktime_user_atoms_read_atom_heap-buffer-overflow.mp4</div><div>----</div><div>libquicktime_1.2.4_quicktime_video_width_heap-buffer-overflow.mp4</div><div>[core] Error: Opening failed (unsupported filetype)</div><div>Couldn't open libquicktime_1.2.4_quicktime_video_width_heap-buffer-overflow.mp4</div><div>----</div><div>vagrant@stretch:/tmp/42148$ qtinfo libquicktime_1.2.4_lqt_frame_duration_heap-buffer-overflow.mp4</div><div>[core] Error: Opening failed (unsupported filetype)</div><div>Couldn't open libquicktime_1.2.4_lqt_frame_duration_heap-buffer-overflow.mp4</div></div><div><br></div><div><br></div><div>Moritz, I guess this patch should also go into stable-security and possibly oldstable security. Can you take it from here or how do we want to proceed?</div><div><br></div><div>Best,</div><div>Reinhard</div><div><br></div><div><br></div><div> </div></div></div>