Описание
Buffer Overflow vulnerability in Ffmpeg v.7.0 and after allows an attacker to cause a denial of service via the libavformat/iamf_writer.c component
A flaw was found in FFmpeg. This buffer overflow vulnerability allows an attacker to cause a denial of service. The flaw occurs when processing data through the libavformat/iamf_writer.c component.
Отчет
This vulnerability affects FFmpeg versions 7.0 through 8.x. The buffer overflow occurs in the IAMF (Immersive Audio Model and Formats) writer component (libavformat/iamf_writer.c), which was introduced in FFmpeg 7.0 in November 2023. FFmpeg versions before 7.0 do not contain IAMF support and are not affected by this vulnerability. The issue was fixed in FFmpeg 9.0. Red Hat products shipping FFmpeg versions before 7.0 are not affected. Community products (Fedora, EPEL) shipping FFmpeg 7.1.5 are affected and require updates.
Меры по смягчению последствий
Update to FFmpeg 9.0 or later. If updating is not possible, avoid processing untrusted IAMF (Immersive Audio Model and Formats) input files.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux AI (RHEL AI) 3 | ffmpeg | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
6.2 Medium
CVSS3
Связанные уязвимости
FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c.
FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c.
FFmpeg before 9.0 has an out-of-bounds read because the copied extrada ...
Buffer Overflow vulnerability in Ffmpeg v.7.0 and after allows an attacker to cause a denial of service via the libavformat/iamf_writer.c component
EPSS
6.2 Medium
CVSS3