FFmpeg: Multiple vulnerabilities

Background FFmpeg is a complete, cross-platform solution to record, convert and stream audio and video. Description Multiple vulnerabilities have been discovered in FFmpeg. Please review the CVE identifiers referenced below for details. Impact A remote attacker could entice a user or automated...

ffmpeg:ffmpeg_BSF_TRACE_HEADERS_fuzzer: Heap-buffer-overflow in cbs_jpeg_split_fragment

Detailed Report: https://oss-fuzz.com/testcase?key=5129591506337792 Project: ffmpeg Fuzzing Engine: honggfuzz Fuzz Target: ffmpegBSFTRACEHEADERSfuzzer Job Type: honggfuzzasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60b000000158 Crash State:...

ffmpeg:ffmpeg_AV_CODEC_ID_G2M_fuzzer: Index-out-of-bounds in epic_decode_run_length

Detailed Report: https://oss-fuzz.com/testcase?key=5199357982015488 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDG2Mfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: epicdecoderunlength epicdecodetile...

ffmpeg:ffmpeg_AV_CODEC_ID_HCA_fuzzer: Global-buffer-overflow in unpack

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5683183715876864 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDHCAfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address:...

ffmpeg:ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer: Heap-buffer-overflow in ff_dsd2pcm_translate

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5693323504517120 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDWAVPACKfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

ffmpeg:ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer: Heap-buffer-overflow in wv_unpack_stereo

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5125168956702720 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDWAVPACKfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address:...

ffmpeg:ffmpeg_AV_CODEC_ID_APNG_fuzzer: Heap-buffer-overflow in inflate

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5135981419429888 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDAPNGfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x6140000d2fd9...

ffmpeg:ffmpeg_AV_CODEC_ID_H264_fuzzer: Heap-buffer-overflow in get_se_golomb

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5746381832847360 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDH264fuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x61100000ea8...

The vulnerability of the flv_write_packet function in the FFmpeg multimedia library, which stems from the lack of checks for empty audio packets, allows attackers to trigger a service failure.

The vulnerability of the flvwritepacket function in the FFmpeg multimedia library lies in the lack of checks to ensure that no empty audio packets are present. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

ffmpeg:ffmpeg_BSF_HEVC_METADATA_fuzzer: Index-out-of-bounds in cbs_h265_read_slice_segment_header

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5160442882424832 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegBSFHEVCMETADATAfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

ffmpeg:ffmpeg_AV_CODEC_ID_ADPCM_IMA_APM_fuzzer: Global-buffer-overflow in adpcm_ima_qt_expand_nibble

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5712770106654720 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDADPCMIMAAPMfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Global-buffer-overflow READ 2 Crash...

ffmpeg:ffmpeg_AV_CODEC_ID_SIREN_fuzzer: Global-buffer-overflow in categorize_regions

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5754041227542528 Project: ffmpeg Fuzzing Engine: honggfuzz Fuzz Target: ffmpegAVCODECIDSIRENfuzzer Job Type: honggfuzzasanffmpeg Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address...

ffmpeg:ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer: Heap-buffer-overflow in decode_deep_rle32

Detailed Report: https://oss-fuzz.com/testcase?key=5111364702175232 Project: ffmpeg Fuzzing Engine: honggfuzz Fuzz Target: ffmpegAVCODECIDIFFILBMfuzzer Job Type: honggfuzzasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x61a000018bb9 Crash State: decodedeeprle32...

ffmpeg:ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer: Heap-buffer-overflow in add_left_pred_int16_c

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5759562508664832 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDMAGICYUVfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

ffmpeg:ffmpeg_AV_CODEC_ID_CDTOONS_fuzzer: Heap-buffer-overflow in cdtoons_render_sprite

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5738148607033344 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDCDTOONSfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

ffmpeg:ffmpeg_AV_CODEC_ID_QDM2_fuzzer: Index-out-of-bounds in qdm2_fft_init_coefficient

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5658290216501248 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDQDM2fuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

ffmpeg:ffmpeg_AV_CODEC_ID_DST_fuzzer: Heap-buffer-overflow in decode_frame

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5735812071424000 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDDSTfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x625000002000...

ffmpeg:ffmpeg_AV_CODEC_ID_MVDV_fuzzer: Heap-buffer-overflow in decode_mvdv

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6279905350516736 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDMVDVfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60a00076f1a...

ffmpeg-promise-peaks (>=0.6.0, <=0.7.6) potentially affected by CVE-2019-10791 via promise-probe (0.1.12)

promise-probe NPM version 0.1.12 is affected by a known vulnerability. The following packages have a transitive dependency on promise-probe and may be impacted: - ffmpeg-promise-peaks =0.6.0, =0.7.6 Source cves: CVE-2019-10791 Source advisory: SNYK:JS-PROMISEPROBE-546816...

ffmpeg:ffmpeg_AV_CODEC_ID_MVHA_fuzzer: Crash in decode_frame

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5711179129552896 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDMVHAfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fd90abbeac0 Crash State:...