Bug 1223254 (CVE-2023-50008) - VUL-0: CVE-2023-50008: ffmpeg,ffmpeg-4: arbitrary code execution via the av_malloc function in libavutil/mem.c
Summary: VUL-0: CVE-2023-50008: ffmpeg,ffmpeg-4: arbitrary code execution via the av_m...
Status: RESOLVED FIXED
Alias: CVE-2023-50008
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/402761/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-50008:8.8:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-22 12:32 UTC by SMASH SMASH
Modified: 2024-06-10 10:20 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-04-22 12:32:34 UTC
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the av_malloc function in libavutil/mem.c:105:9 component.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-50008
https://www.cve.org/CVERecord?id=CVE-2023-50008
https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b
https://trac.ffmpeg.org/ticket/10701
https://bugzilla.redhat.com/show_bug.cgi?id=2276128
Comment 1 Cliff Zhao 2024-04-23 06:04:15 UTC
Hi Camila
Any affected packages list?
Comment 3 Camila Camargo de Matos 2024-04-23 11:15:42 UTC
The fixing commit for this issue, commit 5f87a68c [0], is freeing variables 'uhistogram' and 'vhistogram' in order to avoid the memory leak reported in the upstream ticket 10701 [1].

These variables, however, were not a part of the 'ColorCorrectContext' struct until the changes of commit dc34bf45 [2] were applied to FFmpeg, in version 5.0. The fix for CVE-2023-50008 will, therefore, not apply to FFmpeg versions below 5.0. Considering the nature of the fix, it is also safe to assume that FFmpeg versions 4.4 and below are not affected by the issue described by the upstream ticket 10701 [1].

[0] https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b
[1] https://trac.ffmpeg.org/ticket/10701
[2] https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/dc34bf45c5bf1518e9c1dae8f705e113f939da9e
Comment 4 OBSbugzilla Bot 2024-04-25 09:35:04 UTC
This is an autogenerated message for OBS integration:
This bug (1223254) was mentioned in
https://build.opensuse.org/request/show/1170119 Factory / ffmpeg-6
Comment 5 OBSbugzilla Bot 2024-04-25 23:05:06 UTC
This is an autogenerated message for OBS integration:
This bug (1223254) was mentioned in
https://build.opensuse.org/request/show/1170214 Factory / ffmpeg-5
Comment 7 Andrea Mattiazzo 2024-06-10 10:20:19 UTC
All done, closing.