Skip to content
OpenAdvisories
High USN-5958-1 4 CVEs

ffmpeg vulnerabilities

Published Mar 16, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that FFmpeg could be made to dereference a null
pointer. An attacker could possibly use this to cause a denial of
service via application crash. These issues only affected Ubuntu
16.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04
LTS. (CVE-2022-3109, CVE-2022-3341)

It was discovered that FFmpeg could be made to access an out-of-bounds
frame by the Apple RPZA encoder. An attacker could possibly use this
to cause a denial of service via application crash or access sensitive
information. This issue only affected Ubuntu 22.04 LTS and Ubuntu
22.10. (CVE-2022-3964)

It was discovered that FFmpeg could be made to access an out-of-bounds
frame by the QuickTime encoder. An attacker could possibly use this to
cause a denial of service via application crash or access sensitive
information. This issue only affected Ubuntu 22.10. (CVE-2022-3965)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS ffmpeg 7:2.8.17-0ubuntu0.1+esm5
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS ffmpeg 7:3.4.11-0ubuntu0.1+esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS ffmpeg 7:4.2.7-0ubuntu0.1+esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS ffmpeg 7:4.4.2-0ubuntu0.22.04.1+esm1

Vulnerabilities 4

  • High 7.5
    CVE-2022-3109

    An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return val…

    ffmpeg ffmpeg Debian Ubuntu
  • Medium 5.3
    CVE-2022-3341

    A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c fi…

    ffmpeg ffmpeg Debian Ubuntu
  • Medium 4.3
    CVE-2022-3964

    ffmpeg QuickTime RPZA Video Encoder rpzaenc.c out-of-bounds

    A vulnerability classified as problematic has been found in ffmpeg. This affects an unknown part of the file libavcodec/rpzaenc.c of the component QuickTime RPZA Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. It is possibl…

    ffmpeg ffmpeg ffmpeg Debian Ubuntu Alpine
  • Medium 4.3
    CVE-2022-3965

    ffmpeg QuickTime Graphics Video Encoder smcenc.c smc_encode_stream out-of-bounds

    A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The manipulation of the argument y_size leads to out-of…

    ffmpeg ffmpeg Debian Alpine

References

  • report
    https://ubuntu.com/security/CVE-2022-3109
  • report
    https://ubuntu.com/security/CVE-2022-3341
  • report
    https://ubuntu.com/security/CVE-2022-3964
  • report
    https://ubuntu.com/security/CVE-2022-3965
  • report
    https://bugs.launchpad.net/ubuntu/+source/ffmpeg/+bug/2007269