PT-2022-6793 · FFmpeg+5 · Ffmpeg+5
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
FFmpeg versions prior to 3.0
Description
An issue was discovered in the FFmpeg package, where the
vp3 decode frame function in libavcodec/vp3.c lacks a check of the return value of av malloc(), which will cause a null pointer dereference. This impacts availability and potentially confidentiality. The issue can be exploited by a remote attacker to cause a denial of service.Recommendations
For FFmpeg versions prior to 3.0, consider updating to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the
vp3 decode frame function in libavcodec/vp3.c to minimize the risk of exploitation. Additionally, ensure that error handling for memory allocation is properly implemented to prevent similar issues.Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Ffmpeg
Linuxmint
Suse
Ubuntu