Libav security fixes Jul 2014

[Reinhard Tartler]

trusty should get Libav 9.14:

version 9.14:
- adpcm: Write the proper predictor in trellis mode in IMA QT
- adpcm: Avoid reading out of bounds in the IMA QT trellis encoder
- Check mp3 header before calling avpriv_mpegaudio_decode_header() (bug/705)
- Check if an mp3 header is using a reserved sample rate
- lzo: Handle integer overflow (bug/704)
- avconv: make -shortest work with streamcopy

The lzo issue is claimed to be exploitable (remote code execution) on i386.

[Reinhard Tartler (siretart)]

I have uploaded a proposed package to ppa:siretart/ppa (trusty).

Ubuntu-security-sponsors, please copy it to trusty-security

[Reinhard Tartler (siretart)]

Utopic already has the latest upstream release including all fixes so far in utopic-proposed. I'm not sure why the transition is stuck at this point, though.

[Marc Deslauriers (mdeslaur)]

Thanks for the package!

They are currently building and I will release them when they're done.

[Launchpad Janitor (janitor)]

This bug was fixed in the package libav - 6:9.14-0ubuntu0.14.04.1

---------------
libav (6:9.14-0ubuntu0.14.04.1) trusty-security; urgency=medium

  * New upstream release 9.14:
    - Many security fixes issues LP: #1341216
    - adpcm: Write the proper predictor in trellis mode in IMA QT
    - adpcm: Avoid reading out of bounds in the IMA QT trellis encoder
    - Check mp3 header before calling avpriv_mpegaudio_decode_header() (bug/705)
    - Check if an mp3 header is using a reserved sample rate
    - lzo: Handle integer overflow (bug/704)
    - avconv: make -shortest work with streamcopy
  * Drop broken dpkg-maintscript, LP: #1315672
 -- Reinhard Tartler <email address hidden> Sat, 12 Jul 2014 18:33:45 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package libav - 6:0.8.13-0ubuntu0.13.10.1

---------------
libav (6:0.8.13-0ubuntu0.13.10.1) saucy-security; urgency=medium

  * Update to 0.8.13 to fix multiple security issues (LP: #1341216)
 -- Marc Deslauriers <email address hidden> Tue, 15 Jul 2014 07:31:39 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package libav - 4:0.8.13-0ubuntu0.12.04.1

---------------
libav (4:0.8.13-0ubuntu0.12.04.1) precise-security; urgency=medium

  * Update to 0.8.13 to fix multiple security issues (LP: #1341216)
 -- Marc Deslauriers <email address hidden> Tue, 15 Jul 2014 07:24:55 -0400

[Reinhard Tartler (siretart)]

utopic already works with libav 10, nothing left to do here