ALT Linux Team

Package ffmpeg update in p9 on 2021-02-13

ALT-PU-2021-1331-1

Package ffmpeg updated to version 4.3.1-alt3.2 for branch p9 in task 264927.

Closed vulnerabilities

Published: 2020-01-29

BDU:2021-05271

Уязвимость демультиплексора tty мультимедийной библиотеки FFmpeg, связанная с раскрытием информации, позволяющая нарушителю получить доступ к конфиденциальным данным

Severity: MEDIUM (6.5) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References:
Published: 2021-08-06
Modified: 2024-11-21

CVE-2021-3566

Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitimate "ffconcat" file that references an image, followed by a file the triggers the tty demuxer, the contents of the second file will be copied into the output file verbatim (as long as the `-vcodec copy` option is passed to ffmpeg).

Severity: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References:
VKontakte | Telegram | YouTube | Forum | GitHub | Bugzilla
Version: 2.1.0
Back to top