CVE-2024-31582
published 2024-04-17CVE-2024-31582: FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This…
PriorityP433high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.35%
27.0th percentile
FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ffmpeg | < ffmpeg 7:5.1.7-0+deb12u1 (bookworm) | ffmpeg 7:5.1.7-0+deb12u1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| ffmpeg | ffmpeg | >= 0 < 7:5.1.7-0+deb12u1 | 7:5.1.7-0+deb12u1 |
| ffmpeg | ffmpeg | >= 0 < 7:7.0.1-3 | 7:7.0.1-3 |
| ffmpeg | ffmpeg | >= 0 < 7:7.0.1-3 | 7:7.0.1-3 |
| ffmpeg | ffmpeg | >= 0 < 7:2.8.17-0ubuntu0.1+esm7 | 7:2.8.17-0ubuntu0.1+esm7 |
| ffmpeg | ffmpeg | >= 0 < 7:3.4.11-0ubuntu0.1+esm5 | 7:3.4.11-0ubuntu0.1+esm5 |
| ffmpeg | ffmpeg | >= 0 < 7:4.2.7-0ubuntu0.1+esm5 | 7:4.2.7-0ubuntu0.1+esm5 |
| ffmpeg | ffmpeg | >= 0 < 7:4.4.2-0ubuntu0.22.04.1+esm4 | 7:4.4.2-0ubuntu0.22.04.1+esm4 |
| ffmpeg | ffmpeg | >= 0 < 7:6.1.1-3ubuntu5+esm1 | 7:6.1.1-3ubuntu5+esm1 |
| ffmpeg | ffmpeg | >= 6.1 < 7.0 | 7.0 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.0HIGH
vendor_ubuntu8.0HIGH
vendor_debian7.8HIGH
vendor_oracle7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
FFmpeg vulnerabilities
vendor_ubuntu·2024-05-30·CVSS 8.0
CVE-2023-51795 [HIGH] FFmpeg vulnerabilities
Title: FFmpeg vulnerabilities
Summary: FFmpeg could be made to crash or run programs as your login if it
opened a specially crafted file.
Zeng Yunxiang and Song Jiaxuan discovered that FFmpeg incorrectly handled
certain input files. An attacker could possibly use this issue to cause
FFmpeg to crash, resulting in a denial of service, or potential arbitrary
code execution. This issue only affected Ubuntu 24.04 LTS. (CVE-2023-49501)
Zeng Yunxiang and Song Jiaxuan discovered that FFmpeg incorrectly handled
certain input files. An attacker could possibly use this issue to cause
FFmpeg to crash, resulting in a denial of service, or potential arbitrary
code execution. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.10 and Ubuntu 24.04 LTS.
(CVE-2023-495
Oracle
Oracle Oracle Communications Risk Matrix: Platform (jose4j) — CVE-2023-31582
vendor_oracle·2024-01-15·CVSS 7.5
CVE-2023-31582 [HIGH] Oracle Oracle Communications Risk Matrix: Platform (jose4j) — CVE-2023-31582
Oracle Oracle Communications Risk Matrix: Platform (jose4j) vulnerability
CVE: CVE-2023-31582
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2024 (JAN 2024)
Debian
CVE-2024-31582: ffmpeg - FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerabili...
vendor_debian·2024·CVSS 7.8
CVE-2024-31582 [HIGH] CVE-2024-31582: ffmpeg - FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerabili...
FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input.
Scope: local
bookworm: resolved (fixed in 7:5.1.7-0+deb12u1)
bullseye: resolved
forky: resolved (fixed in 7:7.0.1-3)
sid: resolved (fixed in 7:7.0.1-3)
trixie: resolved (fixed in 7:7.0.1-3)
OSV
ffmpeg vulnerabilities
osv·2024-05-30·CVSS 8.0
CVE-2023-49501 [HIGH] ffmpeg vulnerabilities
ffmpeg vulnerabilities
Zeng Yunxiang and Song Jiaxuan discovered that FFmpeg incorrectly handled
certain input files. An attacker could possibly use this issue to cause
FFmpeg to crash, resulting in a denial of service, or potential arbitrary
code execution. This issue only affected Ubuntu 24.04 LTS. (CVE-2023-49501)
Zeng Yunxiang and Song Jiaxuan discovered that FFmpeg incorrectly handled
certain input files. An attacker could possibly use this issue to cause
FFmpeg to crash, resulting in a denial of service, or potential arbitrary
code execution. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.10 and Ubuntu 24.04 LTS.
(CVE-2023-49502)
Zhang Ling and Zeng Yunxiang discovered that FFmpeg incorrectly handled
certain input files. An attacker could
OSV
CVE-2024-31582: FFmpeg version n6
osv·2024-04-17·CVSS 7.8
CVE-2024-31582 [HIGH] CVE-2024-31582: FFmpeg version n6
FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input.
GHSA
GHSA-8g7x-vrfh-74fj: FFmpeg version n6
ghsa_unreviewed·2024-04-17
CVE-2024-31582 [HIGH] CWE-122 GHSA-8g7x-vrfh-74fj: FFmpeg version n6
FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gist.github.com/1047524396/b47d5efe3bc420fb91dbb77c73c0fff3https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavfilter/vf_codecview.c#L220https://github.com/ffmpeg/ffmpeg/commit/99debe5f823f45a482e1dc08de35879aa9c74bd2https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/https://gist.github.com/1047524396/b47d5efe3bc420fb91dbb77c73c0fff3https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavfilter/vf_codecview.c#L220https://github.com/ffmpeg/ffmpeg/commit/99debe5f823f45a482e1dc08de35879aa9c74bd2https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/https://lists.fedoraproject.org/archives/list/[email protected]/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/https://lists.fedoraproject.org/archives/list/[email protected]/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/
2024-04-17
Published