libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used).

The version of ffmpeg installed on the remote host is prior to 4.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-235-01 advisory.

    New ffmpeg packages are available for Slackware 15.0 to fix security issues.

Tenable has extracted the preceding description block directly from the ffmpeg security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5721 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5721-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 26, 2024                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : ffmpeg     CVE ID         : CVE-2022-48434 CVE-2023-50010 CVE-2023-51793                      CVE-2023-51794 CVE-2023-51798

    Several vulnerabilities have been discovered in the FFmpeg multimedia     framework, which could result in denial of service or potentially the     execution of arbitrary code if malformed files/streams are processed.

    For the oldstable distribution (bullseye), these problems have been fixed     in version 7:4.3.7-0+deb11u1.

    We recommend that you upgrade your ffmpeg packages.

    For the detailed security status of ffmpeg please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ffmpeg

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202312-14 (FFmpeg: Multiple Vulnerabilities)

  - dwa_uncompress in libavcodec/exr.c in FFmpeg 4.4 allows an out-of-bounds array access because dc_count is     not strictly checked. (CVE-2021-33815)

  - adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return     value, which is a necessary step because the second argument to init_get_bits can be crafted.
    (CVE-2021-38171)

  - FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure     at src/libavutil/mathematics.c. (CVE-2021-38291)

  - An integer overflow vulnerability was found in FFmpeg versions before 4.4.2 and before 5.0.1 in     g729_parse() in llibavcodec/g729_parser.c when processing a specially crafted file. (CVE-2022-1475)

  - A vulnerability classified as problematic has been found in ffmpeg. This affects an unknown part of the     file libavcodec/rpzaenc.c of the component QuickTime RPZA Video Encoder. The manipulation of the argument     y_size leads to out-of-bounds read. It is possible to initiate the attack remotely. The name of the patch     is 92f9b28ed84a77138105475beba16c146bdaf984. It is recommended to apply a patch to fix this issue. The     associated identifier of this vulnerability is VDB-213543. (CVE-2022-3964)

  - A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function     smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The     manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely. The     name of the patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to fix     this issue. The identifier of this vulnerability is VDB-213544. (CVE-2022-3965)

  - libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel     state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in     some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used).
    (CVE-2022-48434)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6449-1 advisory.

    It was discovered that FFmpeg incorrectly managed memory resulting

    in a memory leak. An attacker could possibly use this issue to cause a denial of service via application     crash. This issue only

    affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-22038)

    It was discovered that FFmpeg incorrectly handled certain input files,

    leading to an integer overflow. An attacker could possibly use this issue to cause a denial of service via     application crash. This issue only

    affected Ubuntu 20.04 LTS. (CVE-2020-20898, CVE-2021-38090,

    CVE-2021-38091, CVE-2021-38092, CVE-2021-38093, CVE-2021-38094)

    It was discovered that FFmpeg incorrectly managed memory, resulting in a memory leak.

    If a user or automated system were tricked into

    processing a specially crafted input file, a remote attacker could possibly use this issue to cause a     denial of service, or execute

    arbitrary code. (CVE-2022-48434)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2115-1 advisory.

  - In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.
    (CVE-2019-13390)

  - A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of     libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of     avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.
    (CVE-2022-3341)

  - libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel     state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in     some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used).
    (CVE-2022-48434)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2108-1 advisory.

  - libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel     state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in     some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used).
    (CVE-2022-48434)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2087-1 advisory.

  - libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel     state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in     some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used).
    (CVE-2022-48434)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-1e24db98a6 advisory.

    New release with bug fixes across the tree

    Contains security fixes for CVE-2022-48434 and CVE-2022-3109.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-32c3bbbbc9 advisory.

    New release with bug fixes across the tree

    Contains security fix for CVE-2022-48434 .



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
206140	Slackware Linux 15.0 ffmpeg Multiple Vulnerabilities (SSA:2024-235-01)	Nessus	Slackware Local Security Checks	medium
201051	Debian dsa-5721 : ffmpeg - security update	Nessus	Debian Local Security Checks	high
187305	GLSA-202312-14 : FFmpeg: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
183778	Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM : FFmpeg vulnerabilities (USN-6449-1)	Nessus	Ubuntu Local Security Checks	high
175160	SUSE SLES15 Security Update : ffmpeg (SUSE-SU-2023:2115-1)	Nessus	SuSE Local Security Checks	high
175159	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : ffmpeg (SUSE-SU-2023:2108-1)	Nessus	SuSE Local Security Checks	high
175028	SUSE SLED15 / SLES15 / openSUSE 15 : This update has recommended fixes for ffmpeg-4 (SUSE-SU-2023:2087-1)	Nessus	SuSE Local Security Checks	high
174656	Fedora 36 : ffmpeg (2023-1e24db98a6)	Nessus	Fedora Local Security Checks	high
174195	Fedora 37 : ffmpeg (2023-32c3bbbbc9)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2022-48434

high

Tenable Plugins

medium

high

critical

high

high

high

high

high

high