CVE-2025-31499

Jellyfin CVE-2025-31499 affects versions before 10.10.7. An FFmpeg argument-injection flaw exists in endpoints such as /Videos//stream and /Videos//stream. (and similar in AudioController), allowing unsanitized parameters to reach FFmpeg’s command line. This can enable arbitrary file writes and p...

CVE-2025-31499 Jellyfin Vulnerable to Argument Injection in FFmpeg

Jellyfin is an open source self hosted media server. Versions before 10.10.7 are vulnerable to argument injection in FFmpeg. This can be leveraged to possibly achieve remote code execution by anyone with credentials to a low-privileged user. This vulnerability was previously reported in...

CVE-2025-31499

Jellyfin is an open source self hosted media server. Versions before 10.10.7 are vulnerable to argument injection in FFmpeg. This can be leveraged to possibly achieve remote code execution by anyone with credentials to a low-privileged user. This vulnerability was previously reported in...

CVE-2025-31499 Jellyfin Vulnerable to Argument Injection in FFmpeg

Jellyfin is an open source self hosted media server. Versions before 10.10.7 are vulnerable to argument injection in FFmpeg. This can be leveraged to possibly achieve remote code execution by anyone with credentials to a low-privileged user. This vulnerability was previously reported in...

PT-2025-16473 · Jellyfin +1 · Jellyfin +1

Name of the Vulnerable Software and Affected Versions: Jellyfin versions prior to 10.10.7 Description: Jellyfin is an open source self-hosted media server. The issue concerns argument injection in FFmpeg, which can potentially lead to remote code execution by anyone with credentials to a...

CVE-2025-31499: Improper Neutralization of Argument Delimiters in a Command

Jellyfin is an open source self hosted media server. Versions before 10.10.7 are vulnerable to argument injection in FFmpeg. This can be leveraged to possibly achieve remote code execution by anyone with credentials to a low-privileged user. This vulnerability was previously reported in...

ffmpeg:ffmpeg_AV_CODEC_ID_SANM_fuzzer: Heap-buffer-overflow in old_codec4

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6488251907244032 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDSANMfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

ffmpeg:ffmpeg_SWS_fuzzer: Use-of-uninitialized-value in hScale8To19_c

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6322006608117760 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegSWSfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

OPENSUSE-SU-2025:14974-1 ffmpeg-7-7.1.1-1.1 on GA media

These are all security issues fixed in the ffmpeg-7-7.1.1-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE SLES15: libavcodec58_134 / libavformat58_76 / libavutil56_70 / etc (SUSE-SU-2025:1128-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1128-1 advisory. - CVE-2020-22037: Fixed unchecked return value of the initvlc function bsc1186756 - CVE-2024-12361: Fixed null pointer dereference...

Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: CVE-2020-22037: Fixed unchecked return value of the initvlc function bsc1186756 CVE-2024-12361: Fixed null pointer dereference bsc1237358 CVE-2024-35368: Fixed double free via the rkmppretrieveframe function within libavcodec/rkmppdec.c...

SUSE-SU-2025:1128-1 Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: - CVE-2020-22037: Fixed unchecked return value of the initvlc function bsc1186756...

ffmpeg-4-4.4.5-9.1 on GA media (moderate)

ffmpeg-4-4.4.5-9.1 on GA media Announcement ID: openSUSE-SU-2025:14936-1 Rating: moderate Cross-References: CVE-2023-22656 CVE-2023-45221 CVE-2023-47169 CVE-2023-47282 CVE-2023-48368 CVSS scores: CVE-2023-22656 SUSE : 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N CVE-2023-45221 SUSE : 4.8...

OPENSUSE-SU-2025:14936-1 ffmpeg-4-4.4.5-9.1 on GA media

These are all security issues fixed in the ffmpeg-4-4.4.5-9.1 package on the GA media of openSUSE Tumbleweed...

Updated ffmpeg packages fix security vulnerability

FFmpeg NULL Pointer Dereference. CVE-2024-12361...

MGASA-2025-0114 Updated ffmpeg packages fix security vulnerability

FFmpeg NULL Pointer Dereference. CVE-2024-12361...

Mageia: Security Advisory (MGASA-2025-0114)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-34c88263fe)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 40 : ffmpeg (2025-34c88263fe)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-34c88263fe advisory. Backported fix for CVE-2024-12361 . Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has no...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : ffmpeg-4 (SUSE-SU-2025:0958-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0958-1 advisory. - CVE-2022-48434: Fixed use after free in libavcodec/pthreadframe.c bsc1209934 - CVE-2020-22021:...