SUSE update for ffmpeg

Published: 2023-01-02

Risk	Medium
Patch available	YES
Number of vulnerabilities	1
CVE-ID	CVE-2022-3109
CWE-ID	CWE-476
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	SUSE Linux Enterprise Realtime Extension Operating systems & Components / Operating system SUSE Manager Retail Branch Server Operating systems & Components / Operating system SUSE Linux Enterprise Workstation Extension Operating systems & Components / Operating system SUSE Manager Server Operating systems & Components / Operating system SUSE Manager Proxy Operating systems & Components / Operating system SUSE Linux Enterprise Module for Desktop Applications Operating systems & Components / Operating system SUSE Linux Enterprise Desktop Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system openSUSE Leap Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing Operating systems & Components / Operating system SUSE Linux Enterprise Module for Packagehub Subpackages Operating systems & Components / Operating system package or component libswscale4-32bit-debuginfo Operating systems & Components / Operating system package or component libswscale4-32bit Operating systems & Components / Operating system package or component libswresample2-32bit-debuginfo Operating systems & Components / Operating system package or component libswresample2-32bit Operating systems & Components / Operating system package or component libpostproc54-32bit-debuginfo Operating systems & Components / Operating system package or component libpostproc54-32bit Operating systems & Components / Operating system package or component libavutil55-32bit-debuginfo Operating systems & Components / Operating system package or component libavutil55-32bit Operating systems & Components / Operating system package or component libavresample3-32bit-debuginfo Operating systems & Components / Operating system package or component libavresample3-32bit Operating systems & Components / Operating system package or component libavformat57-32bit-debuginfo Operating systems & Components / Operating system package or component libavformat57-32bit Operating systems & Components / Operating system package or component libavfilter6-32bit-debuginfo Operating systems & Components / Operating system package or component libavfilter6-32bit Operating systems & Components / Operating system package or component libavdevice57-32bit-debuginfo Operating systems & Components / Operating system package or component libavdevice57-32bit Operating systems & Components / Operating system package or component libavcodec57-32bit-debuginfo Operating systems & Components / Operating system package or component libavcodec57-32bit Operating systems & Components / Operating system package or component libswscale4-debuginfo Operating systems & Components / Operating system package or component libswscale4 Operating systems & Components / Operating system package or component libswscale-devel Operating systems & Components / Operating system package or component libswresample2-debuginfo Operating systems & Components / Operating system package or component libswresample2 Operating systems & Components / Operating system package or component libswresample-devel Operating systems & Components / Operating system package or component libpostproc54-debuginfo Operating systems & Components / Operating system package or component libpostproc54 Operating systems & Components / Operating system package or component libpostproc-devel Operating systems & Components / Operating system package or component libavutil55-debuginfo Operating systems & Components / Operating system package or component libavutil55 Operating systems & Components / Operating system package or component libavutil-devel Operating systems & Components / Operating system package or component libavresample3-debuginfo Operating systems & Components / Operating system package or component libavresample3 Operating systems & Components / Operating system package or component libavresample-devel Operating systems & Components / Operating system package or component libavformat57-debuginfo Operating systems & Components / Operating system package or component libavformat57 Operating systems & Components / Operating system package or component libavformat-devel Operating systems & Components / Operating system package or component libavfilter6-debuginfo Operating systems & Components / Operating system package or component libavfilter6 Operating systems & Components / Operating system package or component libavfilter-devel Operating systems & Components / Operating system package or component libavdevice57-debuginfo Operating systems & Components / Operating system package or component libavdevice57 Operating systems & Components / Operating system package or component libavdevice-devel Operating systems & Components / Operating system package or component libavcodec57-debuginfo Operating systems & Components / Operating system package or component libavcodec57 Operating systems & Components / Operating system package or component libavcodec-devel Operating systems & Components / Operating system package or component ffmpeg-private-devel Operating systems & Components / Operating system package or component ffmpeg-debugsource Operating systems & Components / Operating system package or component ffmpeg-debuginfo Operating systems & Components / Operating system package or component ffmpeg Operating systems & Components / Operating system package or component
Vendor	SUSE

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) NULL pointer dereference

EUVDB-ID: #VU70598

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3109

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the vp3_decode_frame() function in libavcodec/vp3.c in FFmpeg. A remote attacker can perform a denial of service (DoS) attack.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP3

SUSE Manager Retail Branch Server: 4.3

SUSE Linux Enterprise Workstation Extension: 15-SP4

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP4

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Module for Desktop Applications: 15-SP4

SUSE Linux Enterprise Desktop: 15-SP4

SUSE Linux Enterprise Server: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

libswscale4-32bit-debuginfo: before 3.4.2-150200.11.20.1

libswscale4-32bit: before 3.4.2-150200.11.20.1

libswresample2-32bit-debuginfo: before 3.4.2-150200.11.20.1

libswresample2-32bit: before 3.4.2-150200.11.20.1

libpostproc54-32bit-debuginfo: before 3.4.2-150200.11.20.1

libpostproc54-32bit: before 3.4.2-150200.11.20.1

libavutil55-32bit-debuginfo: before 3.4.2-150200.11.20.1

libavutil55-32bit: before 3.4.2-150200.11.20.1

libavresample3-32bit-debuginfo: before 3.4.2-150200.11.20.1

libavresample3-32bit: before 3.4.2-150200.11.20.1

libavformat57-32bit-debuginfo: before 3.4.2-150200.11.20.1

libavformat57-32bit: before 3.4.2-150200.11.20.1

libavfilter6-32bit-debuginfo: before 3.4.2-150200.11.20.1

libavfilter6-32bit: before 3.4.2-150200.11.20.1

libavdevice57-32bit-debuginfo: before 3.4.2-150200.11.20.1

libavdevice57-32bit: before 3.4.2-150200.11.20.1

libavcodec57-32bit-debuginfo: before 3.4.2-150200.11.20.1

libavcodec57-32bit: before 3.4.2-150200.11.20.1

libswscale4-debuginfo: before 3.4.2-150200.11.20.1

libswscale4: before 3.4.2-150200.11.20.1

libswscale-devel: before 3.4.2-150200.11.20.1

libswresample2-debuginfo: before 3.4.2-150200.11.20.1

libswresample2: before 3.4.2-150200.11.20.1

libswresample-devel: before 3.4.2-150200.11.20.1

libpostproc54-debuginfo: before 3.4.2-150200.11.20.1

libpostproc54: before 3.4.2-150200.11.20.1

libpostproc-devel: before 3.4.2-150200.11.20.1

libavutil55-debuginfo: before 3.4.2-150200.11.20.1

libavutil55: before 3.4.2-150200.11.20.1

libavutil-devel: before 3.4.2-150200.11.20.1

libavresample3-debuginfo: before 3.4.2-150200.11.20.1

libavresample3: before 3.4.2-150200.11.20.1

libavresample-devel: before 3.4.2-150200.11.20.1

libavformat57-debuginfo: before 3.4.2-150200.11.20.1

libavformat57: before 3.4.2-150200.11.20.1

libavformat-devel: before 3.4.2-150200.11.20.1

libavfilter6-debuginfo: before 3.4.2-150200.11.20.1

libavfilter6: before 3.4.2-150200.11.20.1

libavfilter-devel: before 3.4.2-150200.11.20.1

libavdevice57-debuginfo: before 3.4.2-150200.11.20.1

libavdevice57: before 3.4.2-150200.11.20.1

libavdevice-devel: before 3.4.2-150200.11.20.1

libavcodec57-debuginfo: before 3.4.2-150200.11.20.1

libavcodec57: before 3.4.2-150200.11.20.1

libavcodec-devel: before 3.4.2-150200.11.20.1

ffmpeg-private-devel: before 3.4.2-150200.11.20.1

ffmpeg-debugsource: before 3.4.2-150200.11.20.1

ffmpeg-debuginfo: before 3.4.2-150200.11.20.1

ffmpeg: before 3.4.2-150200.11.20.1

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20230007-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.