Title
Version
Used for
Known vulnerabilities from NVD (CVSS score)
GStreamer
1.14.4
The following plugins
are used:
v4l2src
glupload
glcolorconvert
vaapipostproc
vaapih264enc
matroskamux
tcpserversink
tcpclientsrc
filesink
qmlglsink
CVE-2019-9928 (8.8)
Allows a heap-based buffer overflow in the RTSP connection
parser to potentially allow remote code execution.
The displaying unit does not depend directly on RTSP input. It is only
used inside the board from EEPROM encoded Embedded Controller.
OpenSSL
1.0.2p
Used to generate the
private key and
authenticate the public
key used to sign the
upgrade package.
CVE-2019-1559 (5.9)
If an application encounters a fatal protocol error and then calls
SSL_shutdown() twice, the OpenSSL can respond different to
an invalid padding.
The displaying unit validates a signed public key certificate for the
upgrade software and isn’t applicable for this kind of vulnerability.
CVE-2019-12572 (7.8)
A vulnerability in the London Trust Media Private Internet
Access (PIA) VPN Client 1.0.2 for Windows.
Not applicable for displaying unit running Linux without VPN.
CVE-2018-0734 (5.9)
The OpenSSL DSA signature algorithm has been shown to be
vulnerable to a timing side channel attack.
The displaying unit is not applicable for this type of attack.
dcmtk
3.6.3
Used for the DICOM
protocol communicating
to the PACS server.
CVE-2019-1010228 (9.8)
OFFIS.de DCMTK 3.6.3 and below is affected by:
Buffer Overflow. The impact is: Possible code execution and
confirmed Denial of Service.
This vulnerability is on the receive server-side for the DICOM
engine, the displaying unit only transmits the DICOM and doesn’t
parse it from outside sources.
RAUC
1.0
Used for system upgrades.
There are no known vulnerabilities.
47
EN
