This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] FFmpeg fixes 3 vulnerabilities

FFmpeg (a multimedia framework used by popular applications such as VLC Media Player and OBS Studio) fixes 3 vulnerabilities in versions 7.0.2, 6.1.2, 6.0.1, 4.4.5, 4.3.8 and 4.2.10 [1]. A detailed list of the affected versions for each vulnerability can be found in the web version of the report (link below). The vulnerabilities CVE-2024-7055 and CVE-2024-7272 are fixed by Debian in the bookworm (security) release with version 7:5.1.6-0+deb12u1 [2][3]. Slackware fixes the vulnerabilities CVE-2023-47342 and CVE-2024-7055 [4].

FFmpeg - Heap buffer overflow (CVE-2024-7055)
CVSS 6.3 (Medium)

An unauthenticated remote attacker can trigger a heap overflow, which may cause denial of service or unauthorized code execution [2]. A PoC has been published for the vulnerability [3].

The vulnerability is present in product:

  • FFmpeg; >=7, <7.0.2; >=6.1, <6.1.2; >=5.1, <5.1.6; >=4.4, <4.4.5; >=4.3, <4.3.8;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

More information:

The vulnerability was publicly disclosed 6. 8. 2024.

FFmpeg - Heap buffer overflow (CVE-2024-7272)
CVSS 6.3 (Medium)

An unauthenticated remote attacker can trigger a heap overflow, which may cause denial of service or unauthorized code execution [4]. A PoC has been published for the vulnerability [5].

The vulnerability is present in product:

  • FFmpeg; >=5.1, <5.1.6;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

More information:

The vulnerability was publicly disclosed 8. 8. 2024.

FFmpeg - Out of array access (CVE-2023-47342)

An attacker can access memory beyond the array boundary, which may lead to unauthorized access to information, code execution or a DoS attack [6].

The vulnerability is present in product:

  • FFmpeg; ==6.1; ==6; >=5.1, <5.1.4; >=4.4, <4.4.5; >=4.3, <4.3.7; >=4.2, <4.2.10;

More information:

  • CVE-2023-47342 at cve.org, NVD
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org

The vulnerability was publicly disclosed 22. 3. 2024.

By CESNET, z.s.p.o. Martin Krajči on 29. 8. 2024.

CESNET, z.s.p.o. Logo