SUSE update for ffmpeg-4



Risk High
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2023-50010
CWE-ID CWE-119
Exploitation vector Network
Public exploit N/A
Vulnerable software
SUSE Linux Enterprise Server 15 SP4 LTSS
Operating systems & Components / Operating system

SUSE Linux Enterprise High Performance Computing LTSS 15
Operating systems & Components / Operating system

SUSE Linux Enterprise High Performance Computing ESPOS 15
Operating systems & Components / Operating system

SUSE Linux Enterprise Desktop 15 SP4 LTSS
Operating systems & Components / Operating system

SUSE Linux Enterprise Micro
Operating systems & Components / Operating system

SUSE Linux Enterprise Workstation Extension 15
Operating systems & Components / Operating system

SUSE Package Hub 15
Operating systems & Components / Operating system

SUSE Linux Enterprise Server for SAP Applications 15
Operating systems & Components / Operating system

SUSE Linux Enterprise Server 15
Operating systems & Components / Operating system

SUSE Linux Enterprise Real Time 15
Operating systems & Components / Operating system

SUSE Linux Enterprise High Performance Computing 15
Operating systems & Components / Operating system

SUSE Linux Enterprise Desktop 15
Operating systems & Components / Operating system

openSUSE Leap
Operating systems & Components / Operating system

libswresample3_9-64bit
Operating systems & Components / Operating system package or component

libavdevice58_13-64bit-debuginfo
Operating systems & Components / Operating system package or component

libpostproc55_9-64bit-debuginfo
Operating systems & Components / Operating system package or component

libavutil56_70-64bit-debuginfo
Operating systems & Components / Operating system package or component

libswscale5_9-64bit-debuginfo
Operating systems & Components / Operating system package or component

libavformat58_76-64bit
Operating systems & Components / Operating system package or component

libswscale5_9-64bit
Operating systems & Components / Operating system package or component

libavresample4_0-64bit-debuginfo
Operating systems & Components / Operating system package or component

libavfilter7_110-64bit-debuginfo
Operating systems & Components / Operating system package or component

libswresample3_9-64bit-debuginfo
Operating systems & Components / Operating system package or component

libavcodec58_134-64bit
Operating systems & Components / Operating system package or component

libpostproc55_9-64bit
Operating systems & Components / Operating system package or component

libavformat58_76-64bit-debuginfo
Operating systems & Components / Operating system package or component

libavdevice58_13-64bit
Operating systems & Components / Operating system package or component

libavutil56_70-64bit
Operating systems & Components / Operating system package or component

libavcodec58_134-64bit-debuginfo
Operating systems & Components / Operating system package or component

libavresample4_0-64bit
Operating systems & Components / Operating system package or component

libavfilter7_110-64bit
Operating systems & Components / Operating system package or component

libavutil56_70-32bit-debuginfo
Operating systems & Components / Operating system package or component

libavresample4_0-32bit-debuginfo
Operating systems & Components / Operating system package or component

libpostproc55_9-32bit
Operating systems & Components / Operating system package or component

libswresample3_9-32bit
Operating systems & Components / Operating system package or component

libavdevice58_13-32bit
Operating systems & Components / Operating system package or component

libswresample3_9-32bit-debuginfo
Operating systems & Components / Operating system package or component

libavdevice58_13-32bit-debuginfo
Operating systems & Components / Operating system package or component

libavformat58_76-32bit-debuginfo
Operating systems & Components / Operating system package or component

libavcodec58_134-32bit
Operating systems & Components / Operating system package or component

libswscale5_9-32bit-debuginfo
Operating systems & Components / Operating system package or component

libavresample4_0-32bit
Operating systems & Components / Operating system package or component

libswscale5_9-32bit
Operating systems & Components / Operating system package or component

libavformat58_76-32bit
Operating systems & Components / Operating system package or component

libavutil56_70-32bit
Operating systems & Components / Operating system package or component

libpostproc55_9-32bit-debuginfo
Operating systems & Components / Operating system package or component

libavfilter7_110-32bit
Operating systems & Components / Operating system package or component

libavcodec58_134-32bit-debuginfo
Operating systems & Components / Operating system package or component

libavfilter7_110-32bit-debuginfo
Operating systems & Components / Operating system package or component

libavformat58_76-debuginfo
Operating systems & Components / Operating system package or component

ffmpeg-4-libavcodec-devel
Operating systems & Components / Operating system package or component

libavformat58_76
Operating systems & Components / Operating system package or component

libswscale5_9-debuginfo
Operating systems & Components / Operating system package or component

ffmpeg-4-libavdevice-devel
Operating systems & Components / Operating system package or component

libavresample4_0-debuginfo
Operating systems & Components / Operating system package or component

ffmpeg-4-libavutil-devel
Operating systems & Components / Operating system package or component

ffmpeg-4-libavresample-devel
Operating systems & Components / Operating system package or component

ffmpeg-4-libavformat-devel
Operating systems & Components / Operating system package or component

libpostproc55_9
Operating systems & Components / Operating system package or component

libavfilter7_110
Operating systems & Components / Operating system package or component

ffmpeg-4-libswscale-devel
Operating systems & Components / Operating system package or component

ffmpeg-4-debugsource
Operating systems & Components / Operating system package or component

libpostproc55_9-debuginfo
Operating systems & Components / Operating system package or component

libavcodec58_134-debuginfo
Operating systems & Components / Operating system package or component

libavdevice58_13-debuginfo
Operating systems & Components / Operating system package or component

ffmpeg-4-debuginfo
Operating systems & Components / Operating system package or component

ffmpeg-4
Operating systems & Components / Operating system package or component

libavdevice58_13
Operating systems & Components / Operating system package or component

libavcodec58_134
Operating systems & Components / Operating system package or component

libswresample3_9-debuginfo
Operating systems & Components / Operating system package or component

ffmpeg-4-private-devel
Operating systems & Components / Operating system package or component

libavfilter7_110-debuginfo
Operating systems & Components / Operating system package or component

ffmpeg-4-libswresample-devel
Operating systems & Components / Operating system package or component

ffmpeg-4-libavfilter-devel
Operating systems & Components / Operating system package or component

libavutil56_70-debuginfo
Operating systems & Components / Operating system package or component

libswresample3_9
Operating systems & Components / Operating system package or component

libavutil56_70
Operating systems & Components / Operating system package or component

libswscale5_9
Operating systems & Components / Operating system package or component

libavresample4_0
Operating systems & Components / Operating system package or component

ffmpeg-4-libpostproc-devel
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Buffer overflow

EUVDB-ID: #VU89317

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2023-50010

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the set_encoder_id() function in /fftools/ffmpeg_enc.c A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package ffmpeg-4 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server 15 SP4 LTSS: 15-SP4

SUSE Linux Enterprise High Performance Computing LTSS 15: SP4

SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4

SUSE Linux Enterprise Desktop 15 SP4 LTSS: 15-SP4

SUSE Linux Enterprise Micro: 5.5

SUSE Linux Enterprise Workstation Extension 15: SP5

SUSE Package Hub 15: 15-SP5

SUSE Linux Enterprise Server for SAP Applications 15: SP4 - SP5

SUSE Linux Enterprise Server 15: SP4 - SP5

SUSE Linux Enterprise Real Time 15: SP5

SUSE Linux Enterprise High Performance Computing 15: SP4 - SP5

SUSE Linux Enterprise Desktop 15: SP5

openSUSE Leap: 15.4 - 15.5

libswresample3_9-64bit: before 4.4-150400.3.27.1

libavdevice58_13-64bit-debuginfo: before 4.4-150400.3.27.1

libpostproc55_9-64bit-debuginfo: before 4.4-150400.3.27.1

libavutil56_70-64bit-debuginfo: before 4.4-150400.3.27.1

libswscale5_9-64bit-debuginfo: before 4.4-150400.3.27.1

libavformat58_76-64bit: before 4.4-150400.3.27.1

libswscale5_9-64bit: before 4.4-150400.3.27.1

libavresample4_0-64bit-debuginfo: before 4.4-150400.3.27.1

libavfilter7_110-64bit-debuginfo: before 4.4-150400.3.27.1

libswresample3_9-64bit-debuginfo: before 4.4-150400.3.27.1

libavcodec58_134-64bit: before 4.4-150400.3.27.1

libpostproc55_9-64bit: before 4.4-150400.3.27.1

libavformat58_76-64bit-debuginfo: before 4.4-150400.3.27.1

libavdevice58_13-64bit: before 4.4-150400.3.27.1

libavutil56_70-64bit: before 4.4-150400.3.27.1

libavcodec58_134-64bit-debuginfo: before 4.4-150400.3.27.1

libavresample4_0-64bit: before 4.4-150400.3.27.1

libavfilter7_110-64bit: before 4.4-150400.3.27.1

libavutil56_70-32bit-debuginfo: before 4.4-150400.3.27.1

libavresample4_0-32bit-debuginfo: before 4.4-150400.3.27.1

libpostproc55_9-32bit: before 4.4-150400.3.27.1

libswresample3_9-32bit: before 4.4-150400.3.27.1

libavdevice58_13-32bit: before 4.4-150400.3.27.1

libswresample3_9-32bit-debuginfo: before 4.4-150400.3.27.1

libavdevice58_13-32bit-debuginfo: before 4.4-150400.3.27.1

libavformat58_76-32bit-debuginfo: before 4.4-150400.3.27.1

libavcodec58_134-32bit: before 4.4-150400.3.27.1

libswscale5_9-32bit-debuginfo: before 4.4-150400.3.27.1

libavresample4_0-32bit: before 4.4-150400.3.27.1

libswscale5_9-32bit: before 4.4-150400.3.27.1

libavformat58_76-32bit: before 4.4-150400.3.27.1

libavutil56_70-32bit: before 4.4-150400.3.27.1

libpostproc55_9-32bit-debuginfo: before 4.4-150400.3.27.1

libavfilter7_110-32bit: before 4.4-150400.3.27.1

libavcodec58_134-32bit-debuginfo: before 4.4-150400.3.27.1

libavfilter7_110-32bit-debuginfo: before 4.4-150400.3.27.1

libavformat58_76-debuginfo: before 4.4-150400.3.27.1

ffmpeg-4-libavcodec-devel: before 4.4-150400.3.27.1

libavformat58_76: before 4.4-150400.3.27.1

libswscale5_9-debuginfo: before 4.4-150400.3.27.1

ffmpeg-4-libavdevice-devel: before 4.4-150400.3.27.1

libavresample4_0-debuginfo: before 4.4-150400.3.27.1

ffmpeg-4-libavutil-devel: before 4.4-150400.3.27.1

ffmpeg-4-libavresample-devel: before 4.4-150400.3.27.1

ffmpeg-4-libavformat-devel: before 4.4-150400.3.27.1

libpostproc55_9: before 4.4-150400.3.27.1

libavfilter7_110: before 4.4-150400.3.27.1

ffmpeg-4-libswscale-devel: before 4.4-150400.3.27.1

ffmpeg-4-debugsource: before 4.4-150400.3.27.1

libpostproc55_9-debuginfo: before 4.4-150400.3.27.1

libavcodec58_134-debuginfo: before 4.4-150400.3.27.1

libavdevice58_13-debuginfo: before 4.4-150400.3.27.1

ffmpeg-4-debuginfo: before 4.4-150400.3.27.1

ffmpeg-4: before 4.4-150400.3.27.1

libavdevice58_13: before 4.4-150400.3.27.1

libavcodec58_134: before 4.4-150400.3.27.1

libswresample3_9-debuginfo: before 4.4-150400.3.27.1

ffmpeg-4-private-devel: before 4.4-150400.3.27.1

libavfilter7_110-debuginfo: before 4.4-150400.3.27.1

ffmpeg-4-libswresample-devel: before 4.4-150400.3.27.1

ffmpeg-4-libavfilter-devel: before 4.4-150400.3.27.1

libavutil56_70-debuginfo: before 4.4-150400.3.27.1

libswresample3_9: before 4.4-150400.3.27.1

libavutil56_70: before 4.4-150400.3.27.1

libswscale5_9: before 4.4-150400.3.27.1

libavresample4_0: before 4.4-150400.3.27.1

ffmpeg-4-libpostproc-devel: before 4.4-150400.3.27.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2024/suse-su-20241592-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###