PT-2023-26740 · FFmpeg · Ffmpeg

Letianyuan · Publicado 2023-07-28 · Atualizado 2024-08-02 · CVE-2023-39018

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg versions 0.7.0 and below

Description A code injection issue was discovered in the net.bramp.ffmpeg.FFmpeg. component. This issue is exploited by passing an unchecked argument. However, it's noted that there are no realistic use cases where FFmpeg.java uses untrusted input for the path of the executable file, which has led to disputes over the vulnerability's significance.

Recommendations For FFmpeg versions 0.7.0 and below, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2023-39018

GHSA-2JX3-FX5F-R2C6

Produtos afetados

Ffmpeg

Referências · 6

• 🔥 https://github.com/bramp/ffmpeg-cli-wrapper/issues/291 · Exploit
• https://github.com/bramp/ffmpeg-cli-wrapper/blob/master/src/main/java/net/bramp/ffmpeg/FFmpeg.java · Nota
• https://github.com/bramp/ffmpeg-cli-wrapper · Nota
• https://osv.dev/vulnerability/GHSA-2jx3-fx5f-r2c6 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-39018 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-39018 · Aviso do Fabricante