Heap Buffer Overflow in FFmpeg 7.0: Critical Vulnerability Alert
Summary
UBUNTU-CVE-2024-32229: FFmpeg 7.0 contains a heap-buffer-overflow at libavfilter/vf_tiltandshift.c:189:5 in copy_column. Affects ffmpeg versions < 7:7.0.2-1ubuntu1. Fixed in 7:7.0.2-1ubuntu1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely used open-source software suite for handling multimedia data, including audio and video processing. It provides libraries and programs for encoding, decoding, transcoding, muxing, demuxing, streaming, filtering, and playing almost anything that humans and machines have created. The package version 7:7.0.2-1ubuntu1 is affected by a critical vulnerability that can lead to severe security risks.
Vulnerability Detail
FFmpeg 7.0 contains a heap-buffer-overflow vulnerability located at libavfilter/vf_tiltandshift.c:189:5 in the copy_column function. This flaw can be exploited to cause crashes or potentially allow an attacker to execute arbitrary code, leading to unauthorized access or control over affected systems. The vulnerability is classified with a CVSS score of 8.4, indicating a high severity level.
How To Fix
Minimum fixed version
7:7.0.2-1ubuntu1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider disabling the specific functionality that utilizes the affected copy_column function until the package can be updated. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The heap buffer overflow vulnerability in FFmpeg 7.0 poses significant risks to users and systems. It is crucial to update to the patched version to mitigate these risks. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for ffmpeg →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it was allocated for, potentially overwriting adjacent memory and leading to unpredictable behavior.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
Exploitation of this vulnerability could lead to application crashes, unauthorized access, or execution of arbitrary code, compromising the security of the affected system.
While the best course of action is to update the package, you can temporarily disable the functionality that uses the affected code until an update can be applied.
Detailed information about the vulnerability can be found in the Ubuntu Security Notices and the CVE database, specifically under CVE-2024-32229.
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
