Buffer overflow in FFmpeg - CVE-2023-49502

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU89304

Buffer overflow in FFmpeg - CVE-2023-49502

Published: May 9, 2024


Vulnerability identifier: #VU89304
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-49502
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in ff_bwdif_filter_intra_c() function in the libavfilter/bwdifdsp.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

FFmpeg
Debian Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro
Fedora
SUSE Linux Enterprise Server 15 SP4 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Package Hub 15
openSUSE Leap
Ubuntu
openEuler
libswresample2 (Ubuntu package)
ffmpeg (Ubuntu package)
libavresample4 (Ubuntu package)
libavcodec-extra57 (Ubuntu package)
libavcodec57 (Ubuntu package)
libavdevice57 (Ubuntu package)
libavfilter-extra6 (Ubuntu package)
libavfilter6 (Ubuntu package)
libavformat57 (Ubuntu package)
libavresample3 (Ubuntu package)
libavutil55 (Ubuntu package)
libpostproc54 (Ubuntu package)
libavcodec-extra58 (Ubuntu package)
libswscale4 (Ubuntu package)
libavcodec-ffmpeg-extra56 (Ubuntu package)
libavcodec-ffmpeg56 (Ubuntu package)
libavdevice-ffmpeg56 (Ubuntu package)
libavfilter-ffmpeg5 (Ubuntu package)
libavformat-ffmpeg56 (Ubuntu package)
libavresample-ffmpeg2 (Ubuntu package)
libavutil-ffmpeg54 (Ubuntu package)
libpostproc-ffmpeg53 (Ubuntu package)
libswresample-ffmpeg1 (Ubuntu package)
libswscale-ffmpeg3 (Ubuntu package)
libavcodec-extra60 (Ubuntu package)
libswscale7 (Ubuntu package)
libavcodec58 (Ubuntu package)
libswresample4 (Ubuntu package)
libavdevice58 (Ubuntu package)
libpostproc57 (Ubuntu package)
libavfilter-extra7 (Ubuntu package)
libavutil58 (Ubuntu package)
libavfilter7 (Ubuntu package)
libavformat60 (Ubuntu package)
libavformat-extra (Ubuntu package)
libavformat-extra58 (Ubuntu package)
libavfilter9 (Ubuntu package)
libavformat58 (Ubuntu package)
libavfilter-extra9 (Ubuntu package)
libavutil56 (Ubuntu package)
libavdevice60 (Ubuntu package)
libpostproc55 (Ubuntu package)
libavcodec60 (Ubuntu package)
libswresample3 (Ubuntu package)
libswscale5 (Ubuntu package)
libavformat-extra60 (Ubuntu package)
libswresample3_9-64bit
libavfilter7_110-64bit-debuginfo
libavresample4_0-64bit
libavutil56_70-64bit
libavcodec58_134-64bit-debuginfo
libpostproc55_9-64bit
libpostproc55_9-64bit-debuginfo
libswresample3_9-64bit-debuginfo
libavresample4_0-64bit-debuginfo
ffmpeg-4-debugsource
libswscale5_9-64bit
ffmpeg-4-libavfilter-devel
libavfilter7_110
libavresample4_0
libavresample4_0-debuginfo
libavdevice58_13-debuginfo
ffmpeg-4
libavfilter7_110-debuginfo
ffmpeg-4-libswscale-devel
ffmpeg-4-libavformat-devel
libavdevice58_13
ffmpeg-4-libavcodec-devel
ffmpeg-4-libavresample-devel
ffmpeg-4-libavdevice-devel
ffmpeg-4-private-devel
ffmpeg-4-libswresample-devel
libpostproc55_9
libpostproc55_9-debuginfo
ffmpeg-4-libavutil-devel
libavcodec58_134-debuginfo
libavutil56_70-debuginfo
libavformat58_76
libswresample3_9-debuginfo
libswscale5_9-debuginfo
libavcodec58_134
libavformat58_76-debuginfo
libswscale5_9
libavutil56_70
libswresample3_9
ffmpeg-4-debuginfo
libavcodec58_134-32bit-debuginfo
libavutil56_70-64bit-debuginfo
libavfilter7_110-64bit
libavformat58_76-64bit-debuginfo
libswscale5_9-64bit-debuginfo
libavdevice58_13-64bit-debuginfo
libavdevice58_13-64bit
libavcodec58_134-64bit
libavformat58_76-64bit
libavresample4_0-32bit
libswresample3_9-32bit
libswresample3_9-32bit-debuginfo
libavresample4_0-32bit-debuginfo
libavformat58_76-32bit
libavdevice58_13-32bit-debuginfo
libpostproc55_9-32bit-debuginfo
libavutil56_70-32bit-debuginfo
libavfilter7_110-32bit
libpostproc55_9-32bit
libavformat58_76-32bit-debuginfo
libavfilter7_110-32bit-debuginfo
libswscale5_9-32bit-debuginfo
libswscale5_9-32bit
libavutil56_70-32bit
libavdevice58_13-32bit
libavcodec58_134-32bit
ffmpeg-4-libpostproc-devel
ffmpeg (Debian package)
ffmpeg
ffmpeg-debuginfo
ffmpeg-debugsource
ffmpeg-libs
libavdevice
ffmpeg-devel
chromium

How to mitigate CVE-2023-49502

Install updates from vendor's website.

libswresample2 (Ubuntu package) - update to Ubuntu Pro
ffmpeg (Ubuntu package) - addressed in versions Ubuntu Pro, 7:6.0-6ubuntu1.1
libavresample4 (Ubuntu package) - update to Ubuntu Pro
libavcodec-extra57 (Ubuntu package) - update to Ubuntu Pro
libavcodec57 (Ubuntu package) - update to Ubuntu Pro
libavdevice57 (Ubuntu package) - update to Ubuntu Pro
libavfilter-extra6 (Ubuntu package) - update to Ubuntu Pro
libavfilter6 (Ubuntu package) - update to Ubuntu Pro
libavformat57 (Ubuntu package) - update to Ubuntu Pro
libavresample3 (Ubuntu package) - update to Ubuntu Pro
libavutil55 (Ubuntu package) - update to Ubuntu Pro
libpostproc54 (Ubuntu package) - update to Ubuntu Pro
libavcodec-extra58 (Ubuntu package) - update to Ubuntu Pro
libswscale4 (Ubuntu package) - update to Ubuntu Pro
libavcodec-ffmpeg-extra56 (Ubuntu package) - update to Ubuntu Pro
libavcodec-ffmpeg56 (Ubuntu package) - update to Ubuntu Pro
libavdevice-ffmpeg56 (Ubuntu package) - update to Ubuntu Pro
libavfilter-ffmpeg5 (Ubuntu package) - update to Ubuntu Pro
libavformat-ffmpeg56 (Ubuntu package) - update to Ubuntu Pro
libavresample-ffmpeg2 (Ubuntu package) - update to Ubuntu Pro
libavutil-ffmpeg54 (Ubuntu package) - update to Ubuntu Pro
libpostproc-ffmpeg53 (Ubuntu package) - update to Ubuntu Pro
libswresample-ffmpeg1 (Ubuntu package) - update to Ubuntu Pro
libswscale-ffmpeg3 (Ubuntu package) - update to Ubuntu Pro
libavcodec-extra60 (Ubuntu package) - addressed in versions Ubuntu Pro, 7:6.0-6ubuntu1.1
libswscale7 (Ubuntu package) - addressed in versions Ubuntu Pro, 7:6.0-6ubuntu1.1
libavcodec58 (Ubuntu package) - update to Ubuntu Pro
libswresample4 (Ubuntu package) - addressed in versions Ubuntu Pro, 7:6.0-6ubuntu1.1
libavdevice58 (Ubuntu package) - update to Ubuntu Pro
libpostproc57 (Ubuntu package) - addressed in versions Ubuntu Pro, 7:6.0-6ubuntu1.1
libavfilter-extra7 (Ubuntu package) - update to Ubuntu Pro
libavutil58 (Ubuntu package) - addressed in versions Ubuntu Pro, 7:6.0-6ubuntu1.1
libavfilter7 (Ubuntu package) - update to Ubuntu Pro
libavformat60 (Ubuntu package) - addressed in versions Ubuntu Pro, 7:6.0-6ubuntu1.1
libavformat-extra (Ubuntu package) - update to Ubuntu Pro
libavformat-extra58 (Ubuntu package) - update to Ubuntu Pro
libavfilter9 (Ubuntu package) - addressed in versions Ubuntu Pro, 7:6.0-6ubuntu1.1
libavformat58 (Ubuntu package) - update to Ubuntu Pro
libavfilter-extra9 (Ubuntu package) - addressed in versions Ubuntu Pro, 7:6.0-6ubuntu1.1
libavutil56 (Ubuntu package) - update to Ubuntu Pro
libavdevice60 (Ubuntu package) - addressed in versions Ubuntu Pro, 7:6.0-6ubuntu1.1
libpostproc55 (Ubuntu package) - update to Ubuntu Pro
libavcodec60 (Ubuntu package) - addressed in versions Ubuntu Pro, 7:6.0-6ubuntu1.1
libswresample3 (Ubuntu package) - update to Ubuntu Pro
libswscale5 (Ubuntu package) - update to Ubuntu Pro
libavformat-extra60 (Ubuntu package) - addressed in versions Ubuntu Pro, 7:6.0-6ubuntu1.1
libswresample3_9-64bit - update to 4.4-150400.3.24.1
libavfilter7_110-64bit-debuginfo - update to 4.4-150400.3.24.1
libavresample4_0-64bit - update to 4.4-150400.3.24.1
libavutil56_70-64bit - update to 4.4-150400.3.24.1
libavcodec58_134-64bit-debuginfo - update to 4.4-150400.3.24.1
libpostproc55_9-64bit - update to 4.4-150400.3.24.1
libpostproc55_9-64bit-debuginfo - update to 4.4-150400.3.24.1
libswresample3_9-64bit-debuginfo - update to 4.4-150400.3.24.1
libavresample4_0-64bit-debuginfo - update to 4.4-150400.3.24.1
ffmpeg-4-debugsource - update to 4.4-150400.3.24.1
libswscale5_9-64bit - update to 4.4-150400.3.24.1
ffmpeg-4-libavfilter-devel - update to 4.4-150400.3.24.1
libavfilter7_110 - update to 4.4-150400.3.24.1
libavresample4_0 - update to 4.4-150400.3.24.1
libavresample4_0-debuginfo - update to 4.4-150400.3.24.1
libavdevice58_13-debuginfo - update to 4.4-150400.3.24.1
ffmpeg-4 - update to 4.4-150400.3.24.1
libavfilter7_110-debuginfo - update to 4.4-150400.3.24.1
ffmpeg-4-libswscale-devel - update to 4.4-150400.3.24.1
ffmpeg-4-libavformat-devel - update to 4.4-150400.3.24.1
libavdevice58_13 - update to 4.4-150400.3.24.1
ffmpeg-4-libavcodec-devel - update to 4.4-150400.3.24.1
ffmpeg-4-libavresample-devel - update to 4.4-150400.3.24.1
ffmpeg-4-libavdevice-devel - update to 4.4-150400.3.24.1
ffmpeg-4-private-devel - update to 4.4-150400.3.24.1
ffmpeg-4-libswresample-devel - update to 4.4-150400.3.24.1
libpostproc55_9 - update to 4.4-150400.3.24.1
libpostproc55_9-debuginfo - update to 4.4-150400.3.24.1
ffmpeg-4-libavutil-devel - update to 4.4-150400.3.24.1
libavcodec58_134-debuginfo - update to 4.4-150400.3.24.1
libavutil56_70-debuginfo - update to 4.4-150400.3.24.1
libavformat58_76 - update to 4.4-150400.3.24.1
libswresample3_9-debuginfo - update to 4.4-150400.3.24.1
libswscale5_9-debuginfo - update to 4.4-150400.3.24.1
libavcodec58_134 - update to 4.4-150400.3.24.1
libavformat58_76-debuginfo - update to 4.4-150400.3.24.1
libswscale5_9 - update to 4.4-150400.3.24.1
libavutil56_70 - update to 4.4-150400.3.24.1
libswresample3_9 - update to 4.4-150400.3.24.1
ffmpeg-4-debuginfo - update to 4.4-150400.3.24.1
libavcodec58_134-32bit-debuginfo - update to 4.4-150400.3.24.1
libavutil56_70-64bit-debuginfo - update to 4.4-150400.3.24.1
libavfilter7_110-64bit - update to 4.4-150400.3.24.1
libavformat58_76-64bit-debuginfo - update to 4.4-150400.3.24.1
libswscale5_9-64bit-debuginfo - update to 4.4-150400.3.24.1
libavdevice58_13-64bit-debuginfo - update to 4.4-150400.3.24.1
libavdevice58_13-64bit - update to 4.4-150400.3.24.1
libavcodec58_134-64bit - update to 4.4-150400.3.24.1
libavformat58_76-64bit - update to 4.4-150400.3.24.1
libavresample4_0-32bit - update to 4.4-150400.3.24.1
libswresample3_9-32bit - update to 4.4-150400.3.24.1
libswresample3_9-32bit-debuginfo - update to 4.4-150400.3.24.1
libavresample4_0-32bit-debuginfo - update to 4.4-150400.3.24.1
libavformat58_76-32bit - update to 4.4-150400.3.24.1
libavdevice58_13-32bit-debuginfo - update to 4.4-150400.3.24.1
libpostproc55_9-32bit-debuginfo - update to 4.4-150400.3.24.1
libavutil56_70-32bit-debuginfo - update to 4.4-150400.3.24.1
libavfilter7_110-32bit - update to 4.4-150400.3.24.1
libpostproc55_9-32bit - update to 4.4-150400.3.24.1
libavformat58_76-32bit-debuginfo - update to 4.4-150400.3.24.1
libavfilter7_110-32bit-debuginfo - update to 4.4-150400.3.24.1
libswscale5_9-32bit-debuginfo - update to 4.4-150400.3.24.1
libswscale5_9-32bit - update to 4.4-150400.3.24.1
libavutil56_70-32bit - update to 4.4-150400.3.24.1
libavdevice58_13-32bit - update to 4.4-150400.3.24.1
libavcodec58_134-32bit - update to 4.4-150400.3.24.1
ffmpeg-4-libpostproc-devel - update to 4.4-150400.3.24.1
ffmpeg (Debian package) - update to 7:5.1.7-0+deb12u1
ffmpeg - update to 6.1.1-9
ffmpeg-debuginfo - update to 6.1.1-9
ffmpeg-debugsource - update to 6.1.1-9
ffmpeg-libs - update to 6.1.1-9
libavdevice - update to 6.1.1-9
ffmpeg-devel - update to 6.1.1-9
chromium - addressed in versions 124.0.6367.78-1.el9, 124.0.6367.91-1.el9, 124.0.6367.118-1.el9, 124.0.6367.118-2.el8, 124.0.6367.155-1.el8, 124.0.6367.155-1.el9, 124.0.6367.155-1.fc38, 124.0.6367.155-1.fc39, 124.0.6367.155-1.fc40, 124.0.6367.201-1.el8, 124.0.6367.201-1.el9, 124.0.6367.201-1.fc38, 125.0.6422.60-1.el8, 125.0.6422.60-1.el9, 125.0.6422.60-1.fc38, 125.0.6422.76-1.el8, 125.0.6422.76-1.el9

External References

Related Security Bulletins