Bug 1205388 - (CVE-2022-3964) VUL-0: CVE-2022-3964: ffmpeg-4,ffmpeg: out of bounds read in update_block_in_prev_frame()
(CVE-2022-3964)
VUL-0: CVE-2022-3964: ffmpeg-4,ffmpeg: out of bounds read in update_block_in_...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Major
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/347880/
CVSSv3.1:SUSE:CVE-2022-3964:7.1:(AV:N...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2022-11-14 09:30 UTC by Carlos López
Modified: 2023-03-02 15:20 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos López 2022-11-14 09:30:32 UTC
CVE-2022-3964

A vulnerability classified as problematic has been found in ffmpeg. This affects an unknown part of the file libavcodec/rpzaenc.c of the component QuickTime RPZA Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. It is possible to initiate the attack remotely. The name of the patch is 92f9b28ed84a77138105475beba16c146bdaf984. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213543.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3964
http://www.cvedetails.com/cve/CVE-2022-3964/
Comment 1 Carlos López 2022-11-14 09:31:27 UTC
Affected:
- SUSE:SLE-15-SP4:Update/ffmpeg-4
- openSUSE:Factory/ffmpeg-4
- openSUSE:Factory/ffmpeg-5
Comment 2 Jan Engelhardt 2022-11-14 10:59:58 UTC
rpza is not enabled in openSUSE.
Comment 3 Yifan Jiang 2022-11-15 00:56:36 UTC
Hi Alynx, could you help on this please? Thanks.
Comment 4 Alynx Zhou 2022-11-16 01:19:47 UTC
https://build.suse.de/request/show/284471
for SLE-15-SP4
Comment 6 OBSbugzilla Bot 2022-11-16 13:35:03 UTC
This is an autogenerated message for OBS integration:
This bug (1205388) was mentioned in
https://build.opensuse.org/request/show/1036209 Factory / ffmpeg-5
https://build.opensuse.org/request/show/1036210 Factory / ffmpeg-4
Comment 7 Swamp Workflow Management 2022-11-23 14:23:10 UTC
SUSE-SU-2022:4194-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1205388
CVE References: CVE-2022-3964
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    ffmpeg-4-4.4-150400.3.5.1
SUSE Linux Enterprise Workstation Extension 15-SP4 (src):    ffmpeg-4-4.4-150400.3.5.1
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (src):    ffmpeg-4-4.4-150400.3.5.1
SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (src):    ffmpeg-4-4.4-150400.3.5.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Carlos López 2023-03-02 15:20:17 UTC
Released, closing.