PT-2023-26740 · FFmpeg · Ffmpeg

Letianyuan · Published 2023-07-28 · Updated 2024-08-02 · CVE-2023-39018

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg versions 0.7.0 and below

Description A code injection issue was discovered in the net.bramp.ffmpeg.FFmpeg. component. This issue is exploited by passing an unchecked argument. However, it's noted that there are no realistic use cases where FFmpeg.java uses untrusted input for the path of the executable file, which has led to disputes over the vulnerability's significance.

Recommendations For FFmpeg versions 0.7.0 and below, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-39018

GHSA-2JX3-FX5F-R2C6

Affected Products

Ffmpeg

References · 6

• 🔥 https://github.com/bramp/ffmpeg-cli-wrapper/issues/291 · Exploit
• https://osv.dev/vulnerability/GHSA-2jx3-fx5f-r2c6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39018 · Security Note
• https://osv.dev/vulnerability/CVE-2023-39018 · Vendor Advisory
• https://github.com/bramp/ffmpeg-cli-wrapper/blob/master/src/main/java/net/bramp/ffmpeg/FFmpeg.java · Note
• https://github.com/bramp/ffmpeg-cli-wrapper · Note