libopenh264-8: OpenH264 is a free license codec library which supports H.264 encoding anddecoding

OpenH264 is a free license codec library which supports H.264 encoding anddecoding. A vulnerability in the decoding functions of OpenH264 codeclibrary could allow a remote, unauthenticated attacker to trigger a heapoverflow. This vulnerability is due to a race condition between a SequenceParameter Set (SPS) memory allocation and a subsequent non InstantaneousDecoder Refresh (non-IDR) Network Abstraction Layer (NAL) unit memoryusage. An attacker could exploit this vulnerability by crafting a maliciousbitstream and tricking a victim user into processing an arbitrary videocontaining the malicious bistream. An exploit could allow the attacker tocause an unexpected crash in the victim's user decoding client and,possibly, perform arbitrary commands on the victim's host by abusing theheap overflow. This vulnerability affects OpenH264 2.5.0 and earlierreleases. Both Scalable Video Coding (SVC) mode and Advanced Video Coding(AVC) mode are affected by this vulnerability. OpenH264 software releases2.6.0 and later contained the fix for this vulnerability. Users are advisedto upgrade. There are no known workarounds for this vulnerability.### For more informationIf you have any questions or comments about this advisory:* [Open an issue incisco/openh264](https://github.com/cisco/openh264/issues)* Email Cisco Open Source Security([oss-security@cisco.com](mailto:oss-security@cisco.com)) and Cisco PSIRT([psirt@cisco.com](mailto:psirt@cisco.com))### Credits:* **Research:** Octavian Guzu and Andrew Calvano of Meta* **Fix ideation:** Philipp Hancke and Shyam Sadhwani of Meta* **Fix implementation:** Benzheng Zhang (@BenzhengZhang)* **Release engineering:** Benzheng Zhang (@BenzhengZhang)

Where it's fixed