Arbitrary Code Execution

FFmpeg is vulnerable to arbitrary code execution. A use-after-free bug occurs via a crafted EXTINF duration in an m3u8 file because parseplaylist in libavformat/hls.c frees a pointer later access that pointer in avprobeinputformat3 in libavformat/format.c...

Denial Of Service (DoS)

FFmpeg is vulnerable to Denial Of Service DoS. The avcodecopen2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer...

Denial Of Service (DoS)

FFmpeg is vulnerable to heap-based buffer overflow in aviogetstr in libavformat/aviobuf.c because dnnbackendnative.c calls ffdnnloadmodelnative and a certain index check is omitted...

Denial Of Service (DoS)

FFmpeg is vulnerable to denial of service DoS. There is a division by zero at adxwritetrailer in libavformat/rawenc.c...

ffmpeg:ffmpeg_AV_CODEC_ID_AAC_fuzzer: Index-out-of-bounds in output_configure

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5245171336478720 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDAACfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

ffmpeg:ffmpeg_AV_CODEC_ID_CFHD_fuzzer: Heap-buffer-overflow in filter

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5148519623819264 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDCFHDfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x6220000000d...

ffmpeg:ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer: Heap-buffer-overflow in jpegNUMBER_decode_packet

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5700973918683136 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDJPEG2000fuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

ffmpeg:ffmpeg_AV_CODEC_ID_TIFF_fuzzer: Heap-buffer-overflow in tiff_decode_tag

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4843529818603520 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDTIFFfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 2 Crash Address:...

[ASA-202007-4] ffmpeg: arbitrary code execution

Arch Linux Security Advisory ASA-202007-4 ========================================= Severity: High Date : 2020-07-31 CVE-ID : CVE-2020-13904 Package : ffmpeg Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1180 Summary ======= The package ffmpeg before versi...

GLSA-202007-58 : FFmpeg: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202007-58 FFmpeg: Multiple vulnerabilities Multiple vulnerabilities have been discovered in FFmpeg. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifiers for details...

ffmpeg:ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer: Heap-buffer-overflow in jpegNUMBER_read_main_headers

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5165847820369920 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDJPEG2000fuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Addres...

FFmpeg: Multiple vulnerabilities

Background FFmpeg is a complete, cross-platform solution to record, convert and stream audio and video. Description Multiple vulnerabilities have been discovered in FFmpeg. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for...

Debian DLA-2291-1 : ffmpeg security update

Several vulnerabilities have been fixed by upgrading FFmpeg, a widely used multimedia framework, from 3.2.14 to 3.2.15. CVE-2019-13390 rawenc: Only accept the appropriate stream type for raw muxers. CVE-2019-17542 Heap-based buffer overflow in vqadecodechunk. CVE-2020-13904 Use-after-free via a...

Debian: Security Advisory (DLA-2291-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2291-1] ffmpeg security update

Debian LTS Advisory DLA-2291-1 [email protected] https://www.debian.org/lts/security/ July 27, 2020 https://wiki.debian.org/LTS Package : ffmpeg Version : 7:3.2.15-0+deb9u1 CVE ID : CVE-2019-13390 CVE-2019-17542 CVE-2020-13904 Debian Bug : Several vulnerabilities have been fixed by...

DLA-2291-1 ffmpeg - security update

Bulletin has no description...

Code Injection in swooningfish/ffmpeg-web-gui

Description The ffmpeg-web-gui project is a simple video converter written in PHP which uses the ffmpeg command to convert videos in HTML formats. The issue arises at the following line: https://github.com/swooningfish/ffmpeg-web-gui/blob/master/upload-and-convert.phpL176. The arbitrary command...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : FFmpeg vulnerabilities (USN-4431-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4431-1 advisory. It was discovered that FFmpeg incorrectly verified empty audio packets or HEVC data. An attacker could possibly use this issue to...

Ubuntu: Security Advisory (USN-4431-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4431-1: FFmpeg vulnerabilities

It was discovered that FFmpeg incorrectly verified empty audio packets or HEVC data. An attacker could possibly use this issue to cause a denial of service via a crafted file. This issue only affected Ubuntu 16.04 LTS, as it was already fixed in Ubuntu 18.04 LTS. For more information see:...