There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the
    derive_spatial_luma_vector_prediction function at motion.cc. (CVE-2023-49465)

  - Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the
    derive_combined_bipredictive_merging_candidates function at motion.cc. (CVE-2023-49467)

  - Libde265 v1.0.14 was discovered to contain a global buffer overflow vulnerability in the read_coding_unit
    function at slice.cc. (CVE-2023-49468)

远程 Ubuntu 16.04 LTS/18.04 LTS/20.04 LTS/22.04 LTS/23.10 主机上安装的多个程序包受到 USN-6677-1 公告中提及的多个漏洞影响。

  - 发现 Libde265 v1.0.11 位于 decctx.cc 的函数 decoder_context::process_slice_segment_header 会引起分段冲突。(CVE-2023-27102)

  - 发现 Libde265 v1.0.11 位于 motion.cc 的函数 derive_collocated_motion_vectors 会引起堆缓冲区溢出。(CVE-2023-27103)

  - 发现 Libde265 v1.0.12 的函数 pic_parameter_set::dump 中的 num_tile_columns 和 num_tile_row 参数会引起多个缓冲区溢出。(CVE-2023-43887)

  - strukturag libde265 v1.10.12 中的缓冲区溢出漏洞允许本地攻击者通过 slice.cc 组件中的 slice_segment_header 函数造成拒绝服务。(CVE-2023-47471)

  - 发现 Libde265 v1.0.14 在 motion.cc 的 derive_spatial_luma_vector_prediction 函数中含有一个堆缓冲区溢出漏洞。(CVE-2023-49465)

  - 发现 Libde265 v1.0.14 在 motion.cc 的 derive_combined_bipredictive_merging_candidates 函数中含有一个堆缓冲区溢出漏洞。(CVE-2023-49467)

  - 发现 Libde265 v1.0.14 在 slice.cc 的 read_coding_unit 函数中含有一个全局缓冲区溢出漏洞。(CVE-2023-49468)

请注意，Nessus 尚未测试这些问题，而是只依靠应用程序自我报告的版本号来判断。

遠端 Ubuntu 16.04 LTS/18.04 LTS/20.04 LTS/22.04 LTS/23.10 主機上安裝的多個套件受到 USN-6677-1 公告中提及的多個弱點影響。

  - 發現 Libde265 v1.0.11 位於 decctx.cc 的函式 decoder_context::process_slice_segment_header 包含區段違規。(CVE-2023-27102)

  - 據發現，Libde265 v1.0.11 位於 motion.cc 的函式 derive_collocated_motion_vectors 會引起堆積緩衝區溢位。(CVE-2023-27103)

  - 據發現，Libde265 v1.0.12 位於函式 pic_parameter_set::dump 的參數 num_tile_columns and num_tile_row 包含多個緩衝區溢位。(CVE-2023-43887)

  - strukturag libde265 v1.10.12 中的緩衝區溢位弱點允許本機攻擊者透過 slice.cc 元件中的 slice_segment_header 函式造成拒絕服務。(CVE-2023-47471)

  - 據發現，Libde265 v1.0.14 位於 motion.cc 的函式 derivate_spatial_luma_vector_prediction 存在一個堆積緩衝區溢位弱點。(CVE-2023-49465)

  - 據發現，Libde265 v1.0.14 位於 motion.cc 的函式 derive_combined_bipredictive_merging_candidates 存在一個堆積緩衝區溢位弱點。(CVE-2023-49467)

  - 據發現，Libde265 v1.0.14 位於 slice.cc 的函式 read_coding_unit 存在一個全域緩衝區溢位弱點。 (CVE-2023-49468)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

リモートの Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 ホストには、USN-6677-1 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

  - Libde265 v1.0.11 では、decctx.cc の decoder_context::process_slice_segment_header 関数を介したセグメンテーション違反が含まれていることが検出されました。(CVE-2023-27102)

  - Libde265 v1.0.11 で、motion.cc の関数 derive_collocate_motion_vectors を介したヒープバッファオーバーフローが検出されました。(CVE-2023-27103)

  - Libde265 v1.0.12 で、pic_parameter_set::dump 関数の num_tile_columns および num_tile_row パラメーターを介して、複数のバッファオーバーフローが含まれていることが検出されました。(CVE-2023-43887)

  - strukturag libde265 v1.10.12 のバッファオーバーフローの脆弱性により、ローカルの攻撃者が、slice.cc コンポーネントの slice_segment_header 関数を介して、サービス拒否を引き起こす可能性があります。(CVE-2023-47471)

  - Libde265 v1.0.14 には、motion.cc の derive_spatial_luma_vector_prediction 関数にヒープバッファオーバーフローの脆弱性が含まれていることが検出されました。(CVE-2023-49465)

  - Libde265 v1.0.14 には、motion.cc の derive_combined_bipredictive_merging_candidates 関数にヒープバッファオーバーフローの脆弱性が含まれていることが検出されました。(CVE-2023-49467)

  - Libde265 v1.0.14 には、slice.cc の read_coding_unit 関数にグローバルバッファオーバーフローの脆弱性が含まれていることが検出されました。(CVE-2023-49468)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3699 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3699-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     December 30, 2023                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libde265     Version        : 1.0.11-0+deb10u6     CVE ID         : CVE-2023-49465 CVE-2023-49467 CVE-2023-49468


    Three issues have been found in libde265, an open H.265 video codec     implementation. All issues are related to heap-buffer-overflow or global     buffer overflow in different functions.



    For Debian 10 buster, these problems have been fixed in version     1.0.11-0+deb10u6.

    We recommend that you upgrade your libde265 packages.

    For the detailed security status of libde265 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libde265

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6677-1 advisory.

    It was discovered that libde265 could be made to dereference invalid memory. If a user or automated system     were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a     denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-27102)

    It was discovered that libde265 could be made to write out of bounds. If a user or automated system were     tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial     of service or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu     20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-27103)

    It was discovered that libde265 could be made to write out of bounds. If a user or automated system were     tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial     of service or execute arbitrary code. (CVE-2023-43887, CVE-2023-47471, CVE-2023-49465, CVE-2023-49467,     CVE-2023-49468)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
424033	Alpine: multiple libde265 packages: security update to 1.0.15-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2025/4/4	2026/7/2	high
424033	Alpine: multiple libde265 packages: security update to 1.0.15-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2025/4/4	2026/7/2	high
191560	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 LTS：libde265 漏洞 (USN-6677-1)	Nessus	Ubuntu Local Security Checks	2024/3/5	2025/9/3	high
191560	Ubuntu 16.04 LTS / 18.04 LTS/ 20.04 LTS/ 22.04 LTS / 23.10：libde265 弱點 (USN-6677-1)	Nessus	Ubuntu Local Security Checks	2024/3/5	2025/9/3	high
191560	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : libde265 の脆弱性 (USN-6677-1)	Nessus	Ubuntu Local Security Checks	2024/3/5	2025/9/3	high
214467	Debian dla-3699 : libde265-0 - security update	Nessus	Debian Local Security Checks	2025/1/22	2025/1/22	high
191560	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : libde265 vulnerabilities (USN-6677-1)	Nessus	Ubuntu Local Security Checks	2024/3/5	2025/9/3	high

检测

插件搜索

high

high

high

high

high

high

high