Bugzilla – Bug 1226901
VUL-0: CVE-2023-47169: libmfx: improper buffer restrictions
Last modified: 2026-06-05 13:00:42 UTC
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00935.html CVEID: CVE-2023-47169 Description: Improper buffer restrictions in Intel® Media SDK software all versions may allow an authenticated user to potentially enable denial of service via local access. CVSS Base Score: 3.3 Low CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
I already addressed this pro-actively in February for sle15-sp6 and Tumbleweed. ------------------------------------------------------------------- Mon Feb 5 09:07:36 UTC 2024 - Stefan Dirsch <sndirsch@suse.com> - disabled compiling samples, tools and tutorials, which are no longer packaged anyway ------------------------------------------------------------------- Sat Feb 3 18:29:23 UTC 2024 - Stefan Dirsch <sndirsch@suse.com> - only package hardware specific ibmfxhw64 (+ libmfx_<codec>_hw64 plugins) loaded during runtime by libvpl (boo#1219494) - drop -devel and -samples subpackages ------------------------------------------------------------------- Sat Feb 3 11:33:41 UTC 2024 - Stefan Dirsch <sndirsch@suse.com> - added hardware supplements, so it will be installed on GPUs which are not supported by libmfx-gen (boo#1219494) For older products I have no idea how to address that. Intel just tells us to switch to VPL, which means a lot of changes in other components, which we did for SP6 and TW, but probably can't do for older already existing products.
Packages submitted now. Reassigning to security team.
SUSE-SU-2024:3198-1: An update that solves five vulnerabilities, contains one feature and has two security fixes can now be installed. URL: https://www.suse.com/support/update/announcement/2024/suse-su-20243198-1 Category: security (important) Bug References: 1219494, 1226892, 1226897, 1226898, 1226899, 1226900, 1226901 CVE References: CVE-2023-22656, CVE-2023-45221, CVE-2023-47169, CVE-2023-47282, CVE-2023-48368 Jira References: PED-10024 Maintenance Incident: [SUSE:Maintenance:35548](https://smelt.suse.de/incident/35548/) Sources used: SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): gstreamer-plugins-bad-1.16.3-150200.4.22.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): gstreamer-plugins-bad-1.16.3-150200.4.22.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): gstreamer-plugins-bad-1.16.3-150200.4.22.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:3289-1: An update that solves six vulnerabilities, contains one feature and has three security fixes can now be installed. URL: https://www.suse.com/support/update/announcement/2024/suse-su-20243289-1 Category: security (important) Bug References: 1218534, 1219494, 1223263, 1226892, 1226897, 1226898, 1226899, 1226900, 1226901 CVE References: CVE-2023-22656, CVE-2023-45221, CVE-2023-47169, CVE-2023-47282, CVE-2023-48368, CVE-2023-50186 Jira References: PED-10024 Maintenance Incident: [SUSE:Maintenance:33558](https://smelt.suse.de/incident/33558/) Sources used: SUSE Package Hub 15 15-SP5 (src): gstreamer-plugins-bad-1.22.0-150500.3.25.2 openSUSE Leap 15.5 (src): libvpl-2023.0.0-150500.3.2.1, gstreamer-plugins-bad-1.22.0-150500.3.25.2 Basesystem Module 15-SP5 (src): gstreamer-plugins-bad-1.22.0-150500.3.25.2 Desktop Applications Module 15-SP5 (src): libvpl-2023.0.0-150500.3.2.1, gstreamer-plugins-bad-1.22.0-150500.3.25.2 Desktop Applications Module 15-SP6 (src): libvpl-2023.0.0-150500.3.2.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:3295-1: An update that solves six vulnerabilities, contains one feature and has three security fixes can now be installed. URL: https://www.suse.com/support/update/announcement/2024/suse-su-20243295-1 Category: security (important) Bug References: 1218534, 1219494, 1223263, 1226892, 1226897, 1226898, 1226899, 1226900, 1226901 CVE References: CVE-2023-22656, CVE-2023-45221, CVE-2023-47169, CVE-2023-47282, CVE-2023-48368, CVE-2023-50186 Jira References: PED-10024 Maintenance Incident: [SUSE:Maintenance:33559](https://smelt.suse.de/incident/33559/) Sources used: SUSE Manager Proxy 4.3 (src): gstreamer-plugins-bad-1.20.1-150400.3.23.2 SUSE Manager Retail Branch Server 4.3 (src): gstreamer-plugins-bad-1.20.1-150400.3.23.2 SUSE Manager Server 4.3 (src): gstreamer-plugins-bad-1.20.1-150400.3.23.2 openSUSE Leap 15.4 (src): gstreamer-plugins-bad-1.20.1-150400.3.23.2 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): gstreamer-plugins-bad-1.20.1-150400.3.23.2 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): gstreamer-plugins-bad-1.20.1-150400.3.23.2 SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): gstreamer-plugins-bad-1.20.1-150400.3.23.2 SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): gstreamer-plugins-bad-1.20.1-150400.3.23.2 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): gstreamer-plugins-bad-1.20.1-150400.3.23.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:3309-1: An update that solves five vulnerabilities, contains one feature and has two security fixes can now be installed. URL: https://www.suse.com/support/update/announcement/2024/suse-su-20243309-1 Category: security (moderate) Bug References: 1219494, 1226892, 1226897, 1226898, 1226899, 1226900, 1226901 CVE References: CVE-2023-22656, CVE-2023-45221, CVE-2023-47169, CVE-2023-47282, CVE-2023-48368 Jira References: PED-10024 Maintenance Incident: [SUSE:Maintenance:35556](https://smelt.suse.de/incident/35556/) Sources used: SUSE Linux Enterprise Software Development Kit 12 SP5 (src): libmfx-19.1.0-3.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): libmfx-19.1.0-3.3.1 SUSE Linux Enterprise High Performance Computing 12 SP5 (src): libmfx-19.1.0-3.3.1 SUSE Linux Enterprise Server 12 SP5 (src): libmfx-19.1.0-3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2024:0306-1: An update that solves 6 vulnerabilities, contains one feature and has three fixes is now available. Category: security (important) Bug References: 1218534,1219494,1223263,1226892,1226897,1226898,1226899,1226900,1226901 CVE References: CVE-2023-22656,CVE-2023-45221,CVE-2023-47169,CVE-2023-47282,CVE-2023-48368,CVE-2023-50186 JIRA References: PED-10024 Sources used: openSUSE Leap 15.5 (src): gstreamer-plugins-bad-1.22.0-lp155.3.14.1
SUSE-SU-2024:3339-1: An update that solves five vulnerabilities, contains one feature and has two security fixes can now be installed. URL: https://www.suse.com/support/update/announcement/2024/suse-su-20243339-1 Category: security (moderate) Bug References: 1219494, 1226892, 1226897, 1226898, 1226899, 1226900, 1226901 CVE References: CVE-2023-22656, CVE-2023-45221, CVE-2023-47169, CVE-2023-47282, CVE-2023-48368 Jira References: PED-10024 Maintenance Incident: [SUSE:Maintenance:35558](https://smelt.suse.de/incident/35558/) Sources used: openSUSE Leap 15.5 (src): libmfx-22.6.1-150500.3.5.1 Desktop Applications Module 15-SP5 (src): libmfx-22.6.1-150500.3.5.1 SUSE Package Hub 15 15-SP5 (src): libmfx-22.6.1-150500.3.5.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:3358-1: An update that solves six vulnerabilities, contains one feature and has one security fix can now be installed. URL: https://www.suse.com/support/update/announcement/2024/suse-su-20243358-1 Category: security (important) Bug References: 1226892, 1226897, 1226898, 1226899, 1226900, 1226901, 1229026 CVE References: CVE-2023-22656, CVE-2023-45221, CVE-2023-47169, CVE-2023-47282, CVE-2023-48368, CVE-2024-7055 Jira References: PED-10024 Maintenance Incident: [SUSE:Maintenance:35550](https://smelt.suse.de/incident/35550/) Sources used: openSUSE Leap 15.4 (src): ffmpeg-4-4.4-150400.3.42.1 openSUSE Leap 15.5 (src): ffmpeg-4-4.4-150400.3.42.1 SUSE Package Hub 15 15-SP5 (src): ffmpeg-4-4.4-150400.3.42.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): ffmpeg-4-4.4-150400.3.42.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): ffmpeg-4-4.4-150400.3.42.1 SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): ffmpeg-4-4.4-150400.3.42.1 SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): ffmpeg-4-4.4-150400.3.42.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): ffmpeg-4-4.4-150400.3.42.1 SUSE Linux Enterprise Workstation Extension 15 SP5 (src): ffmpeg-4-4.4-150400.3.42.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:3397-1: An update that solves five vulnerabilities, contains one feature and has two security fixes can now be installed. URL: https://www.suse.com/support/update/announcement/2024/suse-su-20243397-1 Category: security (moderate) Bug References: 1219494, 1226892, 1226897, 1226898, 1226899, 1226900, 1226901 CVE References: CVE-2023-22656, CVE-2023-45221, CVE-2023-47169, CVE-2023-47282, CVE-2023-48368 Jira References: PED-10024 Maintenance Incident: [SUSE:Maintenance:35565](https://smelt.suse.de/incident/35565/) Sources used: openSUSE Leap 15.4 (src): libmfx-21.3.4-150400.3.5.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2025:0050-1: An update that solves five vulnerabilities, contains one feature and has two security fixes can now be installed. URL: https://www.suse.com/support/update/announcement/2025/suse-su-20250050-1 Category: security (moderate) Bug References: 1219494, 1226892, 1226897, 1226898, 1226899, 1226900, 1226901 CVE References: CVE-2023-22656, CVE-2023-45221, CVE-2023-47169, CVE-2023-47282, CVE-2023-48368 Jira References: PED-10024 Maintenance Incident: [SUSE:Maintenance:35565](https://smelt.suse.de/incident/35565/) Sources used: SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): libmfx-21.3.4-150400.3.5.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): libmfx-21.3.4-150400.3.5.1 SUSE Linux Enterprise Desktop 15 SP4 LTSS (src): libmfx-21.3.4-150400.3.5.1 SUSE Linux Enterprise Server 15 SP4 LTSS (src): libmfx-21.3.4-150400.3.5.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): libmfx-21.3.4-150400.3.5.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
This is an autogenerated message for OBS integration: This bug (1226901) was mentioned in https://build.opensuse.org/request/show/1324442 15.6 / ffmpeg-6