Ubuntu update for ffmpeg



Published: 2024-07-11
Risk High
Patch available YES
Number of vulnerabilities 15
CVE-ID CVE-2023-49501
CVE-2023-49502
CVE-2023-49528
CVE-2023-50007
CVE-2023-50008
CVE-2023-50009
CVE-2023-50010
CVE-2023-51793
CVE-2023-51794
CVE-2023-51798
CVE-2023-51795
CVE-2023-51796
CVE-2024-31578
CVE-2024-31582
CVE-2024-31585
CWE-ID CWE-119
CWE-122
CWE-416
CWE-193
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		Ubuntu
Operating systems & Components / Operating system

libswscale7 (Ubuntu package)
Operating systems & Components / Operating system package or component

libswresample4 (Ubuntu package)
Operating systems & Components / Operating system package or component

libpostproc57 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavutil58 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavformat60 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavformat-extra60 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavfilter9 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavfilter-extra9 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavdevice60 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavcodec60 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavcodec-extra60 (Ubuntu package)
Operating systems & Components / Operating system package or component

ffmpeg (Ubuntu package)
Operating systems & Components / Operating system package or component

libavdevice-ffmpeg56 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavutil-ffmpeg54 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavcodec-ffmpeg-extra56 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavformat-ffmpeg56 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavcodec-ffmpeg56 (Ubuntu package)
Operating systems & Components / Operating system package or component

libpostproc-ffmpeg53 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavfilter-ffmpeg5 (Ubuntu package)
Operating systems & Components / Operating system package or component

libswscale-ffmpeg3 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavresample-ffmpeg2 (Ubuntu package)
Operating systems & Components / Operating system package or component

libswresample-ffmpeg1 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavcodec57 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavcodec-extra57 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavfilter6 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavfilter-extra6 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavformat57 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavdevice57 (Ubuntu package)
Operating systems & Components / Operating system package or component

libpostproc54 (Ubuntu package)
Operating systems & Components / Operating system package or component

libswscale4 (Ubuntu package)
Operating systems & Components / Operating system package or component

libswresample2 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavresample3 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavutil55 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavresample4 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavcodec58 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavfilter7 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavutil56 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavfilter-extra7 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavcodec-extra58 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavformat-extra58 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavdevice58 (Ubuntu package)
Operating systems & Components / Operating system package or component

libswscale5 (Ubuntu package)
Operating systems & Components / Operating system package or component

libswresample3 (Ubuntu package)
Operating systems & Components / Operating system package or component

libpostproc55 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavformat58 (Ubuntu package)
Operating systems & Components / Operating system package or component

libavformat-extra (Ubuntu package)
Operating systems & Components / Operating system package or component

Vendor Canonical Ltd.

Security Bulletin

This security bulletin contains information about 15 vulnerabilities.

1) Buffer overflow

EUVDB-ID: #VU89303

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-49501

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in config_eq_output function in the libavfilter/asrc_afirsrc.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 24.04

libswscale7 (Ubuntu package): before Ubuntu Pro

libswresample4 (Ubuntu package): before Ubuntu Pro

libpostproc57 (Ubuntu package): before Ubuntu Pro

libavutil58 (Ubuntu package): before Ubuntu Pro

libavformat60 (Ubuntu package): before Ubuntu Pro

libavformat-extra60 (Ubuntu package): before Ubuntu Pro

libavfilter9 (Ubuntu package): before Ubuntu Pro

libavfilter-extra9 (Ubuntu package): before Ubuntu Pro

libavdevice60 (Ubuntu package): before Ubuntu Pro

libavcodec60 (Ubuntu package): before Ubuntu Pro

libavcodec-extra60 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavformat-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

libavformat-extra (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6803-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU89304

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-49502

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in ff_bwdif_filter_intra_c() function in the libavfilter/bwdifdsp.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 24.04

libswscale7 (Ubuntu package): before Ubuntu Pro

libswresample4 (Ubuntu package): before Ubuntu Pro

libpostproc57 (Ubuntu package): before Ubuntu Pro

libavutil58 (Ubuntu package): before Ubuntu Pro

libavformat60 (Ubuntu package): before Ubuntu Pro

libavformat-extra60 (Ubuntu package): before Ubuntu Pro

libavfilter9 (Ubuntu package): before Ubuntu Pro

libavfilter-extra9 (Ubuntu package): before Ubuntu Pro

libavdevice60 (Ubuntu package): before Ubuntu Pro

libavcodec60 (Ubuntu package): before Ubuntu Pro

libavcodec-extra60 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavformat-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

libavformat-extra (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6803-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Heap-based buffer overflow

EUVDB-ID: #VU89298

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-49528

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the in the de_stereo component in af_dialoguenhance.c. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 24.04

libswscale7 (Ubuntu package): before Ubuntu Pro

libswresample4 (Ubuntu package): before Ubuntu Pro

libpostproc57 (Ubuntu package): before Ubuntu Pro

libavutil58 (Ubuntu package): before Ubuntu Pro

libavformat60 (Ubuntu package): before Ubuntu Pro

libavformat-extra60 (Ubuntu package): before Ubuntu Pro

libavfilter9 (Ubuntu package): before Ubuntu Pro

libavfilter-extra9 (Ubuntu package): before Ubuntu Pro

libavdevice60 (Ubuntu package): before Ubuntu Pro

libavcodec60 (Ubuntu package): before Ubuntu Pro

libavcodec-extra60 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavformat-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

libavformat-extra (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6803-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Buffer overflow

EUVDB-ID: #VU89311

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-50007

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the heav_samples_set_silence() function in thelibavutil/samplefmt.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 24.04

libswscale7 (Ubuntu package): before Ubuntu Pro

libswresample4 (Ubuntu package): before Ubuntu Pro

libpostproc57 (Ubuntu package): before Ubuntu Pro

libavutil58 (Ubuntu package): before Ubuntu Pro

libavformat60 (Ubuntu package): before Ubuntu Pro

libavformat-extra60 (Ubuntu package): before Ubuntu Pro

libavfilter9 (Ubuntu package): before Ubuntu Pro

libavfilter-extra9 (Ubuntu package): before Ubuntu Pro

libavdevice60 (Ubuntu package): before Ubuntu Pro

libavcodec60 (Ubuntu package): before Ubuntu Pro

libavcodec-extra60 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavformat-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

libavformat-extra (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6803-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Buffer overflow

EUVDB-ID: #VU89312

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-50008

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in av_malloc() function in libavutil/mem.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 24.04

libswscale7 (Ubuntu package): before Ubuntu Pro

libswresample4 (Ubuntu package): before Ubuntu Pro

libpostproc57 (Ubuntu package): before Ubuntu Pro

libavutil58 (Ubuntu package): before Ubuntu Pro

libavformat60 (Ubuntu package): before Ubuntu Pro

libavformat-extra60 (Ubuntu package): before Ubuntu Pro

libavfilter9 (Ubuntu package): before Ubuntu Pro

libavfilter-extra9 (Ubuntu package): before Ubuntu Pro

libavdevice60 (Ubuntu package): before Ubuntu Pro

libavcodec60 (Ubuntu package): before Ubuntu Pro

libavcodec-extra60 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavformat-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

libavformat-extra (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6803-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Buffer overflow

EUVDB-ID: #VU89316

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-50009

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the ff_gaussian_blur_8() function in libavfilter/edge_template.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 24.04

libswscale7 (Ubuntu package): before Ubuntu Pro

libswresample4 (Ubuntu package): before Ubuntu Pro

libpostproc57 (Ubuntu package): before Ubuntu Pro

libavutil58 (Ubuntu package): before Ubuntu Pro

libavformat60 (Ubuntu package): before Ubuntu Pro

libavformat-extra60 (Ubuntu package): before Ubuntu Pro

libavfilter9 (Ubuntu package): before Ubuntu Pro

libavfilter-extra9 (Ubuntu package): before Ubuntu Pro

libavdevice60 (Ubuntu package): before Ubuntu Pro

libavcodec60 (Ubuntu package): before Ubuntu Pro

libavcodec-extra60 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavformat-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

libavformat-extra (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6803-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Buffer overflow

EUVDB-ID: #VU89317

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-50010

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the set_encoder_id() function in /fftools/ffmpeg_enc.c A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 24.04

libswscale7 (Ubuntu package): before Ubuntu Pro

libswresample4 (Ubuntu package): before Ubuntu Pro

libpostproc57 (Ubuntu package): before Ubuntu Pro

libavutil58 (Ubuntu package): before Ubuntu Pro

libavformat60 (Ubuntu package): before Ubuntu Pro

libavformat-extra60 (Ubuntu package): before Ubuntu Pro

libavfilter9 (Ubuntu package): before Ubuntu Pro

libavfilter-extra9 (Ubuntu package): before Ubuntu Pro

libavdevice60 (Ubuntu package): before Ubuntu Pro

libavcodec60 (Ubuntu package): before Ubuntu Pro

libavcodec-extra60 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavformat-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

libavformat-extra (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6803-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Buffer overflow

EUVDB-ID: #VU89306

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-51793

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in image_copy_plane() function in libavutil/imgutils.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 24.04

libswscale7 (Ubuntu package): before Ubuntu Pro

libswresample4 (Ubuntu package): before Ubuntu Pro

libpostproc57 (Ubuntu package): before Ubuntu Pro

libavutil58 (Ubuntu package): before Ubuntu Pro

libavformat60 (Ubuntu package): before Ubuntu Pro

libavformat-extra60 (Ubuntu package): before Ubuntu Pro

libavfilter9 (Ubuntu package): before Ubuntu Pro

libavfilter-extra9 (Ubuntu package): before Ubuntu Pro

libavdevice60 (Ubuntu package): before Ubuntu Pro

libavcodec60 (Ubuntu package): before Ubuntu Pro

libavcodec-extra60 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavformat-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

libavformat-extra (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6803-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Heap-based buffer overflow

EUVDB-ID: #VU94116

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-51794

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in libavfilter/af_stereowiden.c. A remote attacker can pass specially crafted media file to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 24.04

libswscale7 (Ubuntu package): before Ubuntu Pro

libswresample4 (Ubuntu package): before Ubuntu Pro

libpostproc57 (Ubuntu package): before Ubuntu Pro

libavutil58 (Ubuntu package): before Ubuntu Pro

libavformat60 (Ubuntu package): before Ubuntu Pro

libavformat-extra60 (Ubuntu package): before Ubuntu Pro

libavfilter9 (Ubuntu package): before Ubuntu Pro

libavfilter-extra9 (Ubuntu package): before Ubuntu Pro

libavdevice60 (Ubuntu package): before Ubuntu Pro

libavcodec60 (Ubuntu package): before Ubuntu Pro

libavcodec-extra60 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavformat-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

libavformat-extra (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6803-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Buffer overflow

EUVDB-ID: #VU89310

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-51798

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to a boundary error in libavfilter/vf_minterpolate.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and perform a denial of service (DoS) attack.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 24.04

libswscale7 (Ubuntu package): before Ubuntu Pro

libswresample4 (Ubuntu package): before Ubuntu Pro

libpostproc57 (Ubuntu package): before Ubuntu Pro

libavutil58 (Ubuntu package): before Ubuntu Pro

libavformat60 (Ubuntu package): before Ubuntu Pro

libavformat-extra60 (Ubuntu package): before Ubuntu Pro

libavfilter9 (Ubuntu package): before Ubuntu Pro

libavfilter-extra9 (Ubuntu package): before Ubuntu Pro

libavdevice60 (Ubuntu package): before Ubuntu Pro

libavcodec60 (Ubuntu package): before Ubuntu Pro

libavcodec-extra60 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavformat-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

libavformat-extra (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6803-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Buffer overflow

EUVDB-ID: #VU89307

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-51795

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in showspectrumpic_request_frame() function in libavfilter/avf_showspectrum.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 24.04

libswscale7 (Ubuntu package): before Ubuntu Pro

libswresample4 (Ubuntu package): before Ubuntu Pro

libpostproc57 (Ubuntu package): before Ubuntu Pro

libavutil58 (Ubuntu package): before Ubuntu Pro

libavformat60 (Ubuntu package): before Ubuntu Pro

libavformat-extra60 (Ubuntu package): before Ubuntu Pro

libavfilter9 (Ubuntu package): before Ubuntu Pro

libavfilter-extra9 (Ubuntu package): before Ubuntu Pro

libavdevice60 (Ubuntu package): before Ubuntu Pro

libavcodec60 (Ubuntu package): before Ubuntu Pro

libavcodec-extra60 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavformat-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

libavformat-extra (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6803-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Buffer overflow

EUVDB-ID: #VU89308

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-51796

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the areverse_request_frame() function in libavfilter/f_reverse.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 24.04

libswscale7 (Ubuntu package): before Ubuntu Pro

libswresample4 (Ubuntu package): before Ubuntu Pro

libpostproc57 (Ubuntu package): before Ubuntu Pro

libavutil58 (Ubuntu package): before Ubuntu Pro

libavformat60 (Ubuntu package): before Ubuntu Pro

libavformat-extra60 (Ubuntu package): before Ubuntu Pro

libavfilter9 (Ubuntu package): before Ubuntu Pro

libavfilter-extra9 (Ubuntu package): before Ubuntu Pro

libavdevice60 (Ubuntu package): before Ubuntu Pro

libavcodec60 (Ubuntu package): before Ubuntu Pro

libavcodec-extra60 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavformat-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

libavformat-extra (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6803-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Use-after-free

EUVDB-ID: #VU89299

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-31578

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the av_hwframe_ctx_init() function. A remote attacker can pass specially crated input to the application, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 24.04

libswscale7 (Ubuntu package): before Ubuntu Pro

libswresample4 (Ubuntu package): before Ubuntu Pro

libpostproc57 (Ubuntu package): before Ubuntu Pro

libavutil58 (Ubuntu package): before Ubuntu Pro

libavformat60 (Ubuntu package): before Ubuntu Pro

libavformat-extra60 (Ubuntu package): before Ubuntu Pro

libavfilter9 (Ubuntu package): before Ubuntu Pro

libavfilter-extra9 (Ubuntu package): before Ubuntu Pro

libavdevice60 (Ubuntu package): before Ubuntu Pro

libavcodec60 (Ubuntu package): before Ubuntu Pro

libavcodec-extra60 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavformat-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

libavformat-extra (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6803-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Heap-based buffer overflow

EUVDB-ID: #VU89301

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-31582

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the raw_block_rectangle() function of libavfilter/vf_codecview.c.. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 24.04

libswscale7 (Ubuntu package): before Ubuntu Pro

libswresample4 (Ubuntu package): before Ubuntu Pro

libpostproc57 (Ubuntu package): before Ubuntu Pro

libavutil58 (Ubuntu package): before Ubuntu Pro

libavformat60 (Ubuntu package): before Ubuntu Pro

libavformat-extra60 (Ubuntu package): before Ubuntu Pro

libavfilter9 (Ubuntu package): before Ubuntu Pro

libavfilter-extra9 (Ubuntu package): before Ubuntu Pro

libavdevice60 (Ubuntu package): before Ubuntu Pro

libavcodec60 (Ubuntu package): before Ubuntu Pro

libavcodec-extra60 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavformat-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

libavformat-extra (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6803-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Off-by-one

EUVDB-ID: #VU89302

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-31585

CWE-ID: CWE-193 - Off-by-one Error

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an off-by-one error in libavfilter/avf_showspectrum.c. A remote attacker can trigger an off-by-one error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 24.04

libswscale7 (Ubuntu package): before Ubuntu Pro

libswresample4 (Ubuntu package): before Ubuntu Pro

libpostproc57 (Ubuntu package): before Ubuntu Pro

libavutil58 (Ubuntu package): before Ubuntu Pro

libavformat60 (Ubuntu package): before Ubuntu Pro

libavformat-extra60 (Ubuntu package): before Ubuntu Pro

libavfilter9 (Ubuntu package): before Ubuntu Pro

libavfilter-extra9 (Ubuntu package): before Ubuntu Pro

libavdevice60 (Ubuntu package): before Ubuntu Pro

libavcodec60 (Ubuntu package): before Ubuntu Pro

libavcodec-extra60 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavformat-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

libavformat-extra (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6803-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###