Candidate: CVE-2018-1999013
PublicDate: 2018-07-23 15:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1999013
Description:
 FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a
 use-after-free vulnerability in the realmedia demuxer that can result in
 vulnerability allows attacker to read heap memory. This attack appear to be
 exploitable via specially crafted RM file has to be provided as input. This
 vulnerability appears to have been fixed in
 a7e032a277452366771951e29fd0bf2bd5c029f0 and later.
Ubuntu-Description:
Notes:
 mdeslaur> marking chromium-browser as ignored, since we do full-version
 mdeslaur> updates, and rely on upstream's bundled ffmpeg version
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N [6.5 MEDIUM]

Patches_chromium-browser:
upstream_chromium-browser: released
precise/esm_chromium-browser: DNE
trusty_chromium-browser: ignored (no longer updated)
trusty/esm_chromium-browser: DNE (trusty was ignored [no longer updated])
xenial_chromium-browser: ignored
bionic_chromium-browser: ignored
cosmic_chromium-browser: ignored
disco_chromium-browser: ignored
eoan_chromium-browser: ignored
focal_chromium-browser: ignored
groovy_chromium-browser: ignored
hirsute_chromium-browser: ignored
impish_chromium-browser: ignored
jammy_chromium-browser: ignored
devel_chromium-browser: ignored

Patches_oxide-qt:
upstream_oxide-qt: needs-triage
precise/esm_oxide-qt: DNE
trusty_oxide-qt: ignored (Ubuntu touch end-of-life)
trusty/esm_oxide-qt: DNE (trusty was ignored [Ubuntu touch end-of-life])
xenial_oxide-qt: ignored (Ubuntu touch end-of-life)
esm-infra/xenial_oxide-qt: ignored (Ubuntu touch end-of-life)
bionic_oxide-qt: DNE
cosmic_oxide-qt: DNE
disco_oxide-qt: DNE
eoan_oxide-qt: DNE
focal_oxide-qt: DNE
groovy_oxide-qt: DNE
hirsute_oxide-qt: DNE
impish_oxide-qt: DNE
jammy_oxide-qt: DNE
devel_oxide-qt: DNE

Patches_ffmpeg:
 upstream: https://github.com/FFmpeg/FFmpeg/commit/a7e032a277452366771951e29fd0bf2bd5c029f0
upstream_ffmpeg: needs-triage
precise/esm_ffmpeg: DNE
trusty_ffmpeg: DNE
trusty/esm_ffmpeg: DNE
xenial_ffmpeg: not-affected (code not present)
bionic_ffmpeg: not-affected (7:3.4.4-0ubuntu0.18.04.1)
cosmic_ffmpeg: ignored (reached end-of-life)
disco_ffmpeg: not-affected (7:4.0.2-1)
eoan_ffmpeg: not-affected (7:4.0.2-1)
focal_ffmpeg: not-affected (7:4.0.2-1)
groovy_ffmpeg: not-affected (7:4.0.2-1)
hirsute_ffmpeg: not-affected (7:4.0.2-1)
impish_ffmpeg: not-affected (7:4.0.2-1)
jammy_ffmpeg: not-affected (7:4.0.2-1)
devel_ffmpeg: not-affected (7:4.0.2-1)

Patches_qtwebengine-opensource-src:
upstream_qtwebengine-opensource-src: needs-triage
precise/esm_qtwebengine-opensource-src: DNE
trusty_qtwebengine-opensource-src: DNE
trusty/esm_qtwebengine-opensource-src: DNE
xenial_qtwebengine-opensource-src: DNE
bionic_qtwebengine-opensource-src: needs-triage
cosmic_qtwebengine-opensource-src: ignored (reached end-of-life)
disco_qtwebengine-opensource-src: ignored (reached end-of-life)
eoan_qtwebengine-opensource-src: ignored (reached end-of-life)
focal_qtwebengine-opensource-src: needs-triage
groovy_qtwebengine-opensource-src: ignored (reached end-of-life)
hirsute_qtwebengine-opensource-src: ignored (reached end-of-life)
impish_qtwebengine-opensource-src: needs-triage
jammy_qtwebengine-opensource-src: needs-triage
devel_qtwebengine-opensource-src: needs-triage

Patches_gst-libav1.0:
upstream_gst-libav1.0: needs-triage
precise/esm_gst-libav1.0: DNE
trusty_gst-libav1.0: ignored (reached end-of-life)
trusty/esm_gst-libav1.0: DNE (trusty was needs-triage)
xenial_gst-libav1.0: ignored (end of standard support, was needs-triage)
bionic_gst-libav1.0: needs-triage
cosmic_gst-libav1.0: ignored (reached end-of-life)
disco_gst-libav1.0: ignored (reached end-of-life)
eoan_gst-libav1.0: ignored (reached end-of-life)
focal_gst-libav1.0: needs-triage
groovy_gst-libav1.0: ignored (reached end-of-life)
hirsute_gst-libav1.0: ignored (reached end-of-life)
impish_gst-libav1.0: needs-triage
jammy_gst-libav1.0: needs-triage
devel_gst-libav1.0: needs-triage