Bug 1223269 (CVE-2023-51791) - VUL-0: CVE-2023-51791: ffmpeg: buffer overflow via function gen_alias_map in libavcodec/jpegxl_parser.c
Summary: VUL-0: CVE-2023-51791: ffmpeg: buffer overflow via function gen_alias_map in ...
Status: RESOLVED INVALID
Alias: CVE-2023-51791
Product: openSUSE Distribution
Classification: openSUSE
Component: Other (show other bugs)
Version: Leap 15.6
Hardware: Other Other
: P5 - None : Major (vote)
Target Milestone: ---
Assignee: Jan Engelhardt
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/402764/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-51791:7.8:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-22 17:49 UTC by SMASH SMASH
Modified: 2024-04-22 22:54 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-04-22 17:49:05 UTC 
Buffer Overflow vulenrability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavcodec/jpegxl_parser.c in gen_alias_map.

References:
https://ffmpeg.org/
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-51791
https://www.cve.org/CVERecord?id=CVE-2023-51791
https://trac.ffmpeg.org/ticket/10738
https://bugzilla.redhat.com/show_bug.cgi?id=2276114
Comment 1 Camila Camargo de Matos 2024-04-22 17:51:01 UTC 
No codestream is currently affected by this issue.
Comment 2 Camila Camargo de Matos 2024-04-22 17:55:14 UTC 
The vulnerable code (see the fix in [0] for more information), introduced by the changes of commit 0c0dd23f [1], is only present in versions greater than 6.0. openSUSE:Factory/ffmpeg-6 would be affected, but the fix is already present there as well.


[0] https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=fb54c89a0df3d63198678b17d64aef4dbb599109
[1] https://git.videolan.org/?p=ffmpeg.git;a=commit;h=0c0dd23fe1102313742092c4760596971755814e
Comment 3 Jan Engelhardt 2024-04-22 22:54:48 UTC 
commit fb54c89a0df3d63198678b17d64aef4dbb599109 is reprised on the 6.1.1 branch as 1a3ec3f2f8b2b7588cb81e1aa01b15d5d1725f20.