PT-2023-9358 · FFmpeg+4 · Ffmpeg+4
Zeng Yunxiang
·
Publicado
2023-11-27
·
Atualizado
2025-11-21
·
CVE-2023-50008
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Ffmpeg version v.n6.1-3-g466799d4f5
Description
The issue is related to a buffer overflow in the
av malloc function, located in the libavutil/mem.c component of the Ffmpeg library. This buffer overflow is caused by copying without checking the input data, which can allow an attacker to execute arbitrary code, access confidential data, compromise data integrity, and cause a denial of service.Recommendations
For Ffmpeg version v.n6.1-3-g466799d4f5, consider disabling the
av malloc function in the libavutil/mem.c component as a temporary workaround until a patch is available. Restrict access to the libavutil/mem.c component to minimize the risk of exploitation. Avoid using the av malloc function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Astra Linux
Debian
Ffmpeg
Linuxmint
Ubuntu