All errata/sisyphus/ALT-PU-2024-18135-1
ALT-PU-2024-18135-1

Package update ffmpeg in branch sisyphus

Version6.1.1-alt1
Task#338178
Published2024-01-20
Max severityCRITICAL
Severity:

Closed issues (13)

BDU:2024-00860
MEDIUM6.3

Уязвимость функции jpegxl_anim_read_packet() декодировщика JPEG XL мультимедийной библиотеки FFmpeg, позволяющая нарушителю выполнить произвольный код

Published: 2024-01-31
CVSS 3.xMEDIUM 6.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
References
BDU:2024-00861
MEDIUM6.3

Уязвимость декодировщика JPEG XL мультимедийной библиотеки FFmpeg, позволяющая нарушителю выполнить произвольный код

Published: 2024-01-31
CVSS 3.xMEDIUM 6.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
References
BDU:2024-05020
HIGH8.0

Уязвимость компонента config_eq_output (libavfilter/asrc_afirsrc.c) мультимедийной библиотеки FFmpeg, позволяющая нарушителю выполнить произвольный код

Published: 2024-07-05Modified: 2025-11-05
CVSS 3.xHIGH 8.0
CVSS:3.x/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:C/A:C
References
BDU:2024-05025
CRITICAL9.8

Уязвимость файла libavcodec/cbs_h266_syntax_template.c мультимедийной библиотеки FFmpeg, позволяющая нарушителю выполнить произвольный код

Published: 2024-07-05
CVSS 3.xCRITICAL 9.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0CRITICAL 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
References
BDU:2024-05030
HIGH8.0

Уязвимость компонента de_stereo (af_dialoguenhance.c) мультимедийной библиотеки FFmpeg, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании

Published: 2024-07-05Modified: 2025-11-05
CVSS 3.xHIGH 8.0
CVSS:3.x/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:C/A:C
References
CVE-2023-46407
MEDIUM5.5

FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() function.

Published: 2023-10-27Modified: 2025-08-11
CVSS 3.xMEDIUM 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
CVE-2023-47470
HIGH7.8

Buffer Overflow vulnerability in Ffmpeg before github commit 4565747056a11356210ed8edcecb920105e40b60 allows a remote attacker to achieve an out-of-array write, execute arbitrary code, and cause a denial of service (DoS) via the ref_pic_list_struct function in libavcodec/evc_ps.c

Published: 2023-11-16Modified: 2025-08-11
CVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
CVE-2023-49501
HIGH8.0

Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component.

Published: 2024-04-19Modified: 2025-11-04
CVSS 3.xHIGH 8.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
References
CVE-2023-49528
HIGH8.0

Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component.

Published: 2024-04-12Modified: 2025-11-04
CVSS 3.xHIGH 8.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
References
CVE-2024-22860
CRITICAL9.8

Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the jpegxl_anim_read_packet component in the JPEG XL Animation decoder.

Published: 2024-01-27Modified: 2025-08-11
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
CVE-2024-22862
CRITICAL9.8

Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the JJPEG XL Parser.

Published: 2024-01-27Modified: 2025-08-11
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
CVE-2024-31581
CRITICAL9.8

FFmpeg version n6.1 was discovered to contain an improper validation of array index vulnerability in libavcodec/cbs_h266_syntax_template.c. This vulnerability allows attackers to cause undefined behavior within the application.

Published: 2024-04-17Modified: 2025-11-04
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References