Bug 1223085 (CVE-2024-31582)

Summary: VUL-0: CVE-2024-31582: ffmpeg,ffmpeg-4: heap buffer overflow in the draw_block_rectangle function of libavfilter/vf_codecview.c.
Product: [openSUSE] openSUSE Distribution Reporter: SMASH SMASH <smash_bz>
Component: OtherAssignee: Security Team bot <security-team>
Status: IN_PROGRESS --- QA Contact: E-mail List <qa-bugs>
Severity: Major    
Priority: P3 - Medium CC: camila.matos, jengelh, qzhao
Version: Leap 15.5   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/402501/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-31582:8.6:(AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description SMASH SMASH 2024-04-18 13:54:26 UTC 
FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-31582
https://www.cve.org/CVERecord?id=CVE-2024-31582
https://gist.github.com/1047524396/b47d5efe3bc420fb91dbb77c73c0fff3
https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavfilter/vf_codecview.c#L220
https://github.com/ffmpeg/ffmpeg/commit/99debe5f823f45a482e1dc08de35879aa9c74bd2
Comment 1 Camila Camargo de Matos 2024-04-18 13:56:37 UTC 
The function containing the vulnerable code snippet (as per the fix commit in [0]), was only introduced in FFmpeg version 5 (see [1]), meaning that versions below version 5.0 are not affected by this issue.

[0] https://github.com/ffmpeg/ffmpeg/commit/99debe5f8
[1] https://github.com/ffmpeg/ffmpeg/commit/da5497a1a22
Comment 3 Camila Camargo de Matos 2024-04-18 13:58:38 UTC 
In openSUSE:Factory, two packages are affected by this issue:

- openSUSE:Factory/ffmpeg-5
- openSUSE:Factory/ffmpeg-6
Comment 4 Cliff Zhao 2024-04-22 13:56:28 UTC 
@jengelh:
Don't change the bug assignee, I'm already working on this bug.
Comment 5 OBSbugzilla Bot 2024-04-22 17:16:12 UTC 
This is an autogenerated message for OBS integration:
This bug (1223085) was mentioned in
https://build.opensuse.org/request/show/1169718 Factory / ffmpeg-6
https://build.opensuse.org/request/show/1169719 Factory / ffmpeg-5