Bugzilla – Bug 1223272
VUL-0: CVE-2023-51793: ffmpeg: heap buffer overflow in the image_copy_plane function in libavutil/imgutils.c
Last modified: 2024-05-19 14:05:39 UTC
Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavutil/imgutils.c:353:9 in image_copy_plane. References: https://ffmpeg.org/ http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-51793 https://www.cve.org/CVERecord?id=CVE-2023-51793 https://trac.ffmpeg.org/ticket/10743 https://bugzilla.redhat.com/show_bug.cgi?id=2276114
For ffmpeg packages which include versions earlier than FFmpeg 4.4, no fix needs to be applied. That is because versions earlier than 4.4 are not affected by this vulnerability. The vulnerable code was introduced together with the changes from commit f0dd5c00 [0], which is only a part of FFmpeg starting on version 4.4 [0] https://git.videolan.org/?p=ffmpeg.git;a=commit;h=f0dd5c00cb9a1212db1a09b975072bb46b962718
Fix 0ecc1f0e48930723d7a467761b66850811c23e62 is included in refs/tags/6.1.1 as commit 8b8b4bdef3. openSUSE:Factory/ffmpeg-6 already has 6.1.1.
Cliff, can you also include this in your current ffmpeg submissions, thanks.
We still need this bug to trace ALP, SLE and anywhere ffmpeg-4 appears.
This is an autogenerated message for OBS integration: This bug (1223272) was mentioned in https://build.opensuse.org/request/show/1170214 Factory / ffmpeg-5 https://build.opensuse.org/request/show/1170215 Factory / ffmpeg-4
SUSE-SU-2024:1470-1: An update that solves three vulnerabilities can now be installed. Category: security (important) Bug References: 1223070, 1223235, 1223272 CVE References: CVE-2023-49502, CVE-2023-51793, CVE-2024-31578 Maintenance Incident: [SUSE:Maintenance:33554](https://smelt.suse.de/incident/33554/) Sources used: SUSE Linux Enterprise Workstation Extension 15 SP5 (src): ffmpeg-4-4.4-150400.3.24.1 openSUSE Leap 15.4 (src): ffmpeg-4-4.4-150400.3.24.1 openSUSE Leap 15.5 (src): ffmpeg-4-4.4-150400.3.24.1 SUSE Package Hub 15 15-SP5 (src): ffmpeg-4-4.4-150400.3.24.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): ffmpeg-4-4.4-150400.3.24.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): ffmpeg-4-4.4-150400.3.24.1 SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): ffmpeg-4-4.4-150400.3.24.1 SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): ffmpeg-4-4.4-150400.3.24.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): ffmpeg-4-4.4-150400.3.24.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.