media-video/ffmpeg-4.4.8 — Security Advisories

▸ GLSA 202312-14 FFmpeg: Multiple Vulnerabilities this version unaffected high local and remote 2023-12-23

Multiple vulnerabilitiies have been discovered in FFmpeg, the worst of which could lead to code execution

Announced: 2023-12-23
Revised: 2023-12-23
Access: local and remote
Bugs: #795696 #842267 #881523 #903805
Advisory: https://security.gentoo.org/glsa/202312-14

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/ffmpeg	*	< 6.0, < 4.4.3	>= 6.0, >= 4.4.3

Background

FFmpeg is a complete solution to record, convert and stream audio and video.

Description

Multiple vulnerabilities have been discovered in FFmpeg. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All FFmpeg 4 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/ffmpeg-4.4.3"

All FFmpeg 6 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/ffmpeg-6.0"

References

▸ GLSA 202105-24 FFmpeg: Multiple vulnerabilities this version unaffected normal local, remote 2021-05-26

Multiple vulnerabilities have been found in FFmpeg, the worst of which could result in the arbitrary execution of code.

Announced: 2021-05-26
Revised: 2021-05-26
Access: local, remote
Bugs: #763315 #781146
Advisory: https://security.gentoo.org/glsa/202105-24

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/ffmpeg	*	< 4.4	>= 4.4

Background

FFmpeg is a complete, cross-platform solution to record, convert and stream audio and video.

Description

Multiple vulnerabilities have been discovered in FFmpeg. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could entice a user to open a specially crafted media file using FFmpeg, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All FFmpeg users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/ffmpeg-4.4"

References

▸ GLSA 202007-58 FFmpeg: Multiple vulnerabilities this version unaffected normal remote 2020-07-28

Multiple vulnerabilities have been found in FFmpeg, the worst of which could result in the arbitrary execution of code.

Announced: 2020-07-28
Revised: 2020-07-28
Access: remote
Bugs: #718012 #719940 #727450
Advisory: https://security.gentoo.org/glsa/202007-58

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/ffmpeg	*	< 4.2.4	>= 4.2.4

Background

FFmpeg is a complete, cross-platform solution to record, convert and stream audio and video.

Description

Multiple vulnerabilities have been discovered in FFmpeg. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All FFmpeg users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/ffmpeg-4.2.4"

References

▸ GLSA 202003-65 FFmpeg: Multiple vulnerabilities this version unaffected normal local, remote 2020-03-30

Multiple vulnerabilities have been found in FFmpeg, the worst of which allows remote attackers to execute arbitrary code.

Announced: 2020-03-30
Revised: 2020-03-30
Access: local, remote
Bugs: #660924 #692418 #711144
Advisory: https://security.gentoo.org/glsa/202003-65

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/ffmpeg	*	>= 4	>= 4.2.0

Background

FFmpeg is a complete, cross-platform solution to record, convert and stream audio and video.

Description

Multiple vulnerabilities have been discovered in FFmpeg. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could entice a user or automated system using FFmpeg to process a specially crafted file, resulting in the execution of arbitrary code or a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All FFmpeg 4.x users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/ffmpeg-4.2.0"

References

▸ GLSA 201705-05 FFmpeg: Multiple vulnerabilities this version unaffected normal remote 2017-05-09

Multiple vulnerabilities have been found in FFmpeg, the worst of which allows remote attackers to execute arbitrary code.

Announced: 2017-05-09
Revised: 2017-05-09
Access: remote
Bugs: #608868 #610810
Advisory: https://security.gentoo.org/glsa/201705-05

Affected packages

Package	Arch	Vulnerable	Unaffected
media-plugins/gst-plugins-libav	*	< 1.10.4	>= 1.10.4
media-video/ffmpeg	*	< 3.2.4	>= 3.2.4

Background

FFmpeg is a complete, cross-platform solution to record, convert and stream audio and video.

Description

Multiple vulnerabilities have been discovered in FFmpeg. Please review the CVE identifiers referenced below for details.

gst-plugins-libav is affected because this package is bundling a vulnerable FFmpeg version.

Impact

A remote attacker could entice a user or automated system using FFmpeg to process a specially crafted file, resulting in the execution of arbitrary code or a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All FFmpeg users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/ffmpeg-3.2.4"

All gst-plugins-libav users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=media-plugins/gst-plugins-libav-1.10.4"

References

▸ GLSA 201701-71 FFmpeg: Multiple vulnerabilities this version unaffected normal remote 2017-01-29

Multiple vulnerabilities have been found in FFmpeg, the worst of which may allow remote attackers to cause a Denial of Service condition.

Announced: 2017-01-29
Revised: 2017-01-29
Access: remote
Bugs: #596760
Advisory: https://security.gentoo.org/glsa/201701-71

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/ffmpeg	*	< 2.8.10	>= 2.8.10

Background

FFmpeg is a complete, cross-platform solution to record, convert and stream audio and video.

Description

Multiple vulnerabilities have been discovered in FFmpeg. Please review the CVE identifiers referenced below for details.

Impact

Remote attackers could cause a Denial of Service condition via various crafted media file types or have other unspecified impacts.

Workaround

There is no known workaround at this time.

Resolution

All FFmpeg users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/ffmpeg-2.8.10"

References

▸ GLSA 201606-09 FFmpeg: Multiple vulnerabilities this version unaffected normal remote 2016-06-18

Multiple vulnerabilities have been found in FFmpeg, the worst of which could lead to arbitrary code execution or Denial of Service condition.

Announced: 2016-06-18
Revised: 2016-06-18
Access: remote
Bugs: #528554 #553732 #571868 #577458
Advisory: https://security.gentoo.org/glsa/201606-09

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/ffmpeg	*	< 2.8.6	>= 2.8.6

Background

FFmpeg is a complete, cross-platform solution to record, convert and stream audio and video.

Description

Multiple vulnerabilities have been discovered in FFmpeg. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could possibly execute arbitrary code or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All FFmpeg users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/ffmpeg-2.8.6"

References

▸ GLSA 201603-06 FFmpeg: Multiple vulnerabilities this version unaffected normal remote 2016-03-12

Multiple vulnerabilities have been found in FFmpeg, the worst of which could lead to arbitrary code execution or Denial of Service condition.

Announced: 2016-03-12
Revised: 2016-03-12
Access: remote
Bugs: #485228 #486692 #488052 #492742 #493452 #494038 #515282 #520132 #536218 #537558 #548006 #553734
Advisory: https://security.gentoo.org/glsa/201603-06

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/ffmpeg	*	< 2.6.3	>= 2.6.3

Background

FFmpeg is a complete, cross-platform solution to record, convert and stream audio and video.

Description

Multiple vulnerabilities have been discovered in FFmpeg. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could possibly execute arbitrary code or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All FFmpeg users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/ffmpeg-2.6.3"

References

CVE-2013-0860
CVE-2013-0861
CVE-2013-0862
CVE-2013-0863
CVE-2013-0864
CVE-2013-0865
CVE-2013-0866
CVE-2013-0867
CVE-2013-0868
CVE-2013-0872
CVE-2013-0873
CVE-2013-0874
CVE-2013-0875
CVE-2013-0876
CVE-2013-0877
CVE-2013-0878
CVE-2013-4263
CVE-2013-4264
CVE-2013-4265
CVE-2013-7008
CVE-2013-7009
CVE-2013-7010
CVE-2013-7011
CVE-2013-7012
CVE-2013-7013
CVE-2013-7014
CVE-2013-7015
CVE-2013-7016
CVE-2013-7017
CVE-2013-7018
CVE-2013-7019
CVE-2013-7020
CVE-2013-7021
CVE-2013-7022
CVE-2013-7023
CVE-2013-7024
CVE-2014-2097
CVE-2014-2098
CVE-2014-2263
CVE-2014-5271
CVE-2014-5272
CVE-2014-7937
CVE-2014-8541
CVE-2014-8542
CVE-2014-8543
CVE-2014-8544
CVE-2014-8545
CVE-2014-8546
CVE-2014-8547
CVE-2014-8548
CVE-2014-8549
CVE-2014-9316
CVE-2014-9317
CVE-2014-9318
CVE-2014-9319
CVE-2014-9602
CVE-2014-9603
CVE-2014-9604
CVE-2015-3395

▸ GLSA 201310-12 FFmpeg: Multiple vulnerabilities this version unaffected high remote 2013-10-25

Multiple vulnerabilities were found in FFmpeg, the worst of which might enable remote attackers to cause user-assisted execution of arbitrary code.

Announced: 2013-10-25
Revised: 2013-10-25
Access: remote
Bugs: #285719 #307755 #339036 #352481 #365273 #378801 #382301 #384095 #385511 #389807 #391421 #397893 #401069 #411369 #420305 #433772 #439054 #454420 #465496 #473302 #473790 #476218 #482136
Advisory: https://security.gentoo.org/glsa/201310-12

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/ffmpeg	*	< 1.0.7	>= 1.0.7

Background

FFmpeg is a complete solution to record, convert and stream audio and video.

Description

Multiple vulnerabilities have been discovered in FFmpeg. Please review the CVE identifiers and FFmpeg changelogs referenced below for details.

Impact

A remote attacker could entice a user to open a specially crafted media file, possibly leading to the execution of arbitrary code with the privileges of the user running the application or a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All FFmpeg users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/ffmpeg-1.0.7"

References

CVE-2009-4631
CVE-2009-4632
CVE-2009-4633
CVE-2009-4634
CVE-2009-4635
CVE-2009-4636
CVE-2009-4637
CVE-2009-4638
CVE-2009-4639
CVE-2009-4640
CVE-2010-3429
CVE-2010-3908
CVE-2010-4704
CVE-2010-4704
CVE-2010-4705
CVE-2011-1931
CVE-2011-3362
CVE-2011-3893
CVE-2011-3895
CVE-2011-3929
CVE-2011-3934
CVE-2011-3935
CVE-2011-3936
CVE-2011-3937
CVE-2011-3940
CVE-2011-3941
CVE-2011-3944
CVE-2011-3945
CVE-2011-3946
CVE-2011-3947
CVE-2011-3949
CVE-2011-3950
CVE-2011-3951
CVE-2011-3952
CVE-2011-3973
CVE-2011-3974
CVE-2011-4351
CVE-2011-4352
CVE-2011-4353
CVE-2011-4364
CVE-2012-0947
CVE-2012-2771
CVE-2012-2772
CVE-2012-2773
CVE-2012-2774
CVE-2012-2775
CVE-2012-2776
CVE-2012-2777
CVE-2012-2778
CVE-2012-2779
CVE-2012-2780
CVE-2012-2781
CVE-2012-2782
CVE-2012-2783
CVE-2012-2784
CVE-2012-2785
CVE-2012-2786
CVE-2012-2787
CVE-2012-2788
CVE-2012-2789
CVE-2012-2790
CVE-2012-2791
CVE-2012-2792
CVE-2012-2793
CVE-2012-2794
CVE-2012-2795
CVE-2012-2796
CVE-2012-2797
CVE-2012-2798
CVE-2012-2799
CVE-2012-2800
CVE-2012-2801
CVE-2012-2802
CVE-2012-2803
CVE-2012-2804
CVE-2012-2805
CVE-2013-3670
CVE-2013-3671
CVE-2013-3672
CVE-2013-3673
CVE-2013-3674
CVE-2013-3675
FFmpeg 0.10.x Changelog
FFmpeg 1.0.x Changelog
NGS Secure Research NGS00068
Secunia Advisory SA36760
Secunia Advisory SA46134

▸ GLSA 200903-33 FFmpeg: Multiple vulnerabilities this version unaffected normal remote 2009-03-19

Multiple vulnerabilities in FFmpeg may lead to the remote execution of arbitrary code or a Denial of Service.

Announced: 2009-03-19
Revised: 2009-03-19
Access: remote
Bugs: #231831 #231834 #245313 #257217 #257381
Advisory: https://security.gentoo.org/glsa/200903-33

Affected packages

Package	Arch	Vulnerable	Unaffected
media-plugins/gst-plugins-ffmpeg	*	< 0.10.5	>= 0.10.5
media-video/ffmpeg	*	< 0.4.9_p20090201	>= 0.4.9_p20090201
media-video/mplayer	*	< 1.0_rc2_p28450	>= 1.0_rc2_p28450

Background

FFmpeg is a complete solution to record, convert and stream audio and video. gst-plugins-ffmpeg is a FFmpeg based gstreamer plugin which includes a vulnerable copy of FFmpeg code. Mplayer is a multimedia player which also includes a vulnerable copy of the code.

Description

Multiple vulnerabilities were found in FFmpeg:

astrange reported a stack-based buffer overflow in the str_read_packet() in libavformat/psxstr.c when processing .str files (CVE-2008-3162).
Multiple buffer overflows in libavformat/utils.c (CVE-2008-4866).
A buffer overflow in libavcodec/dca.c (CVE-2008-4867).
An unspecified vulnerability in the avcodec_close() function in libavcodec/utils.c (CVE-2008-4868).
Unspecified memory leaks (CVE-2008-4869).
Tobias Klein repoerted a NULL pointer dereference due to an integer signedness error in the fourxm_read_header() function in libavformat/4xm.c (CVE-2009-0385).

Impact

A remote attacker could entice a user to open a specially crafted media file, possibly leading to the execution of arbitrary code with the privileges of the user running the application, or a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All FFmpeg users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/ffmpeg-0.4.9_p20090201"

All gst-plugins-ffmpeg users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-plugins/gst-plugins-ffmpeg-0.10.5"

All Mplayer users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/mplayer-1.0_rc2_p28450"

References

▸ GLSA 200609-09 FFmpeg: Buffer overflows this version unaffected normal remote 2006-09-13

FFmpeg is vulnerable to multiple buffer overflows that might be exploited to execute arbitrary code.

Announced: 2006-09-13
Revised: 2006-12-13 (revision 2)
Access: remote
Bugs: #133520
Advisory: https://security.gentoo.org/glsa/200609-09

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/ffmpeg	*	< 0.4.9_p20060530	>= 0.4.9_p20060530

Background

FFmpeg is a very fast video and audio converter.

Description

FFmpeg contains buffer overflows in the AVI processing code.

Impact

An attacker could trigger the buffer overflows by enticing a user to load a specially crafted AVI file in an application using the FFmpeg library. This might result in the execution of arbitrary code in the context of the running application.

Workaround

There is no known workaround at this time.

Resolution

All FFmpeg users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/ffmpeg-0.4.9_p20060530"

References

▸ GLSA 200601-06 xine-lib, FFmpeg: Heap-based buffer overflow this version unaffected normal remote 2006-01-10

xine-lib and FFmpeg are vulnerable to a buffer overflow that may be exploited by attackers to execute arbitrary code.

Announced: 2006-01-10
Revised: 2006-01-10
Access: remote
Bugs: #115849 #116181
Advisory: https://security.gentoo.org/glsa/200601-06

Affected packages

Package	Arch	Vulnerable	Unaffected
media-libs/xine-lib	*	< 1.1.1-r3	>= 1.1.1-r3
media-video/ffmpeg	*	< 0.4.9_p20051216	>= 0.4.9_p20051216

Background

xine is a GPL high-performance, portable and reusable multimedia playback engine. xine-lib is xine's core engine. FFmpeg is a very fast video and audio converter and is used in xine-lib.

Description

Simon Kilvington has reported a vulnerability in FFmpeg libavcodec. The flaw is due to a buffer overflow error in the "avcodec_default_get_buffer()" function. This function doesn't properly handle specially crafted PNG files as a result of a heap overflow.

Impact

A remote attacker could entice a user to run an FFmpeg based application on a maliciously crafted PNG file, resulting in the execution of arbitrary code with the permissions of the user running the application.

Workaround

There is no known workaround at this time.

Resolution

All xine-lib users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/xine-lib-1.1.1-r3"

All FFmpeg users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/ffmpeg-0.4.9_p20051216"