Ubuntu update for ffmpeg

Published: 2023-12-05

Risk	Medium
Patch available	YES
Number of vulnerabilities	6
CVE-ID	CVE-2020-22024 CVE-2020-22039 CVE-2020-22040 CVE-2020-22043 CVE-2020-22051 CVE-2021-28429
CWE-ID	CWE-119 CWE-401 CWE-190
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Ubuntu Operating systems & Components / Operating system libavdevice-ffmpeg56 (Ubuntu package) Operating systems & Components / Operating system package or component libav-tools (Ubuntu package) Operating systems & Components / Operating system package or component libavutil-ffmpeg54 (Ubuntu package) Operating systems & Components / Operating system package or component libavcodec-ffmpeg-extra56 (Ubuntu package) Operating systems & Components / Operating system package or component libavformat-ffmpeg56 (Ubuntu package) Operating systems & Components / Operating system package or component libavcodec-ffmpeg56 (Ubuntu package) Operating systems & Components / Operating system package or component libpostproc-ffmpeg53 (Ubuntu package) Operating systems & Components / Operating system package or component libavfilter-ffmpeg5 (Ubuntu package) Operating systems & Components / Operating system package or component libswscale-ffmpeg3 (Ubuntu package) Operating systems & Components / Operating system package or component libavresample-ffmpeg2 (Ubuntu package) Operating systems & Components / Operating system package or component libswresample-ffmpeg1 (Ubuntu package) Operating systems & Components / Operating system package or component libavcodec57 (Ubuntu package) Operating systems & Components / Operating system package or component libavcodec-extra57 (Ubuntu package) Operating systems & Components / Operating system package or component libavfilter6 (Ubuntu package) Operating systems & Components / Operating system package or component libavfilter-extra6 (Ubuntu package) Operating systems & Components / Operating system package or component libavformat57 (Ubuntu package) Operating systems & Components / Operating system package or component libavdevice57 (Ubuntu package) Operating systems & Components / Operating system package or component libpostproc54 (Ubuntu package) Operating systems & Components / Operating system package or component libswscale4 (Ubuntu package) Operating systems & Components / Operating system package or component libswresample2 (Ubuntu package) Operating systems & Components / Operating system package or component libavresample3 (Ubuntu package) Operating systems & Components / Operating system package or component libavutil55 (Ubuntu package) Operating systems & Components / Operating system package or component libavresample4 (Ubuntu package) Operating systems & Components / Operating system package or component libavcodec58 (Ubuntu package) Operating systems & Components / Operating system package or component libavfilter7 (Ubuntu package) Operating systems & Components / Operating system package or component libavutil56 (Ubuntu package) Operating systems & Components / Operating system package or component libavfilter-extra7 (Ubuntu package) Operating systems & Components / Operating system package or component libavcodec-extra58 (Ubuntu package) Operating systems & Components / Operating system package or component libavdevice58 (Ubuntu package) Operating systems & Components / Operating system package or component libswscale5 (Ubuntu package) Operating systems & Components / Operating system package or component libswresample3 (Ubuntu package) Operating systems & Components / Operating system package or component libpostproc55 (Ubuntu package) Operating systems & Components / Operating system package or component libavformat58 (Ubuntu package) Operating systems & Components / Operating system package or component ffmpeg (Ubuntu package) Operating systems & Components / Operating system package or component libavfilter-extra (Ubuntu package) Operating systems & Components / Operating system package or component libavcodec-extra (Ubuntu package) Operating systems & Components / Operating system package or component
Vendor	Canonical Ltd.

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Buffer overflow

EUVDB-ID: #VU83851

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-22024

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the lagfun_frame16 function in libavfilter/vf_lagfun.c. A remote attacker can trigger memory corruption and cause a denial of service condition on the target system.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 20.04

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libav-tools (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavfilter-extra (Ubuntu package): before Ubuntu Pro

libavcodec-extra (Ubuntu package): before Ubuntu Pro

CPE2.3

External links

http://ubuntu.com/security/notices/USN-6430-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Memory leak

EUVDB-ID: #VU83852

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-22039

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the inavi_add_ientry function. A remote attacker can perform a denial of service attack.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 20.04

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libav-tools (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavfilter-extra (Ubuntu package): before Ubuntu Pro

libavcodec-extra (Ubuntu package): before Ubuntu Pro

CPE2.3

External links

http://ubuntu.com/security/notices/USN-6430-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Memory leak

EUVDB-ID: #VU83853

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-22040

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the v_frame_alloc function in frame.c. A remote attacker can perform a denial of service attack.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 20.04

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libav-tools (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavfilter-extra (Ubuntu package): before Ubuntu Pro

libavcodec-extra (Ubuntu package): before Ubuntu Pro

CPE2.3

External links

http://ubuntu.com/security/notices/USN-6430-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Memory leak

EUVDB-ID: #VU83854

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-22043

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak within the fifo_alloc_common function in libavutil/fifo.c. A remote attacker can force the application to leak memory and perform denial of service attack.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 20.04

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libav-tools (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavfilter-extra (Ubuntu package): before Ubuntu Pro

libavcodec-extra (Ubuntu package): before Ubuntu Pro

CPE2.3

External links

http://ubuntu.com/security/notices/USN-6430-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Memory leak

EUVDB-ID: #VU83855

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-22051

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the filter_frame function in vf_tile.c. A remote attacker can perform a denial of service attack.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 20.04

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libav-tools (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavfilter-extra (Ubuntu package): before Ubuntu Pro

libavcodec-extra (Ubuntu package): before Ubuntu Pro

CPE2.3

External links

http://ubuntu.com/security/notices/USN-6430-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Integer overflow

EUVDB-ID: #VU83856

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28429

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow within the av_timecode_make_string in libavutil/timecode.c. A local user can pass specially crafted data to the application, trigger integer overflow and cause a denial of service condition on the target system.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 20.04

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libav-tools (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

libavfilter-extra (Ubuntu package): before Ubuntu Pro

libavcodec-extra (Ubuntu package): before Ubuntu Pro

CPE2.3

External links

http://ubuntu.com/security/notices/USN-6430-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.