Bugzilla – Bug 1223085
VUL-0: CVE-2024-31582: ffmpeg,ffmpeg-4: heap buffer overflow in the draw_block_rectangle function of libavfilter/vf_codecview.c.
Last modified: 2024-05-06 03:43:20 UTC
FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-31582 https://www.cve.org/CVERecord?id=CVE-2024-31582 https://gist.github.com/1047524396/b47d5efe3bc420fb91dbb77c73c0fff3 https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavfilter/vf_codecview.c#L220 https://github.com/ffmpeg/ffmpeg/commit/99debe5f823f45a482e1dc08de35879aa9c74bd2
The function containing the vulnerable code snippet (as per the fix commit in [0]), was only introduced in FFmpeg version 5 (see [1]), meaning that versions below version 5.0 are not affected by this issue. [0] https://github.com/ffmpeg/ffmpeg/commit/99debe5f8 [1] https://github.com/ffmpeg/ffmpeg/commit/da5497a1a22
In openSUSE:Factory, two packages are affected by this issue: - openSUSE:Factory/ffmpeg-5 - openSUSE:Factory/ffmpeg-6
@jengelh: Don't change the bug assignee, I'm already working on this bug.
This is an autogenerated message for OBS integration: This bug (1223085) was mentioned in https://build.opensuse.org/request/show/1169718 Factory / ffmpeg-6 https://build.opensuse.org/request/show/1169719 Factory / ffmpeg-5