Summary
It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected
Ubuntu 24.04 LTS. (CVE-2024-35365)
It was discovered that FFmpeg did not correctly handle certain integer
calculations. An attacker could possibly use this issue to cause a denial
of service. (CVE-2024-35366)
It was discovered that FFmpeg may perform an out-of-bounds read under
certain circumstances. An attacker could possibly use this issue to cause
a denial of service. (CVE-2024-35367)
It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2024-35368)
It was discovered that FFmpeg did not correctly handle certain inputs,
which could lead to an integer overflow. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2024-36613, CVE-2024-36616, CVE-2024-36618)
It was discovered that FFmpeg did not correctly handle certain inputs,
which could lead to an integer overflow. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code. This
issue only affected Ubuntu 24.04 LTS. (CVE-2024-36619)
It was discovered that FFmpeg did not correctly handle certain memory
operations. A remote attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-7055)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | ffmpeg | 7:2.8.17-0ubuntu0.1+esm12 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | ffmpeg | 7:3.4.11-0ubuntu0.1+esm10 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | ffmpeg | 7:4.2.7-0ubuntu0.1+esm10 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | ffmpeg | 7:4.4.2-0ubuntu0.22.04.1+esm9 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | ffmpeg | 7:6.1.1-3ubuntu5+esm5 |
Vulnerabilities 9
-
Critical 9.8
FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c.
-
Critical 9.1
FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavf…
-
Critical 9.1
FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer
-
High 8.8
FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specificall…
-
Medium 6.5
An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of…
-
Medium 6.3
FFmpeg pnmdec.c pnm_decode_frame heap-based overflow
A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack re…
-
Medium 6.2
FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, poten…
-
Medium 6.2
FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, p…
-
Medium 5.3
FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow …
References
-
report
https://ubuntu.com/security/CVE-2024-7055
-
report
https://ubuntu.com/security/CVE-2024-35365
-
report
https://ubuntu.com/security/CVE-2024-35366
-
report
https://ubuntu.com/security/CVE-2024-35367
-
report
https://ubuntu.com/security/CVE-2024-35368
-
report
https://ubuntu.com/security/CVE-2024-36613
-
report
https://ubuntu.com/security/CVE-2024-36616
-
report
https://ubuntu.com/security/CVE-2024-36618
-
report
https://ubuntu.com/security/CVE-2024-36619