SUSE update for ffmpeg-4

Published: 2024-08-12

Risk	High
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2023-51798 CVE-2024-32230
CWE-ID	CWE-119
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	SUSE Linux Enterprise Workstation Extension 15 Operating systems & Components / Operating system SUSE Package Hub 15 Operating systems & Components / Operating system SUSE Linux Enterprise Real Time 15 Operating systems & Components / Operating system openSUSE Leap Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system SUSE Linux Enterprise Desktop 15 Operating systems & Components / Operating system libavdevice58_13-64bit-debuginfo Operating systems & Components / Operating system package or component libavutil56_70-64bit-debuginfo Operating systems & Components / Operating system package or component libswresample3_9-64bit Operating systems & Components / Operating system package or component libpostproc55_9-64bit Operating systems & Components / Operating system package or component libavutil56_70-64bit Operating systems & Components / Operating system package or component libavformat58_76-64bit-debuginfo Operating systems & Components / Operating system package or component libavcodec58_134-64bit-debuginfo Operating systems & Components / Operating system package or component libswscale5_9-64bit Operating systems & Components / Operating system package or component libswresample3_9-64bit-debuginfo Operating systems & Components / Operating system package or component libavcodec58_134-64bit Operating systems & Components / Operating system package or component libavfilter7_110-64bit Operating systems & Components / Operating system package or component libavformat58_76-64bit Operating systems & Components / Operating system package or component libavdevice58_13-64bit Operating systems & Components / Operating system package or component libswscale5_9-64bit-debuginfo Operating systems & Components / Operating system package or component libpostproc55_9-64bit-debuginfo Operating systems & Components / Operating system package or component libavresample4_0-64bit Operating systems & Components / Operating system package or component libavresample4_0-64bit-debuginfo Operating systems & Components / Operating system package or component libavfilter7_110-64bit-debuginfo Operating systems & Components / Operating system package or component libavformat58_76-32bit-debuginfo Operating systems & Components / Operating system package or component libpostproc55_9-32bit-debuginfo Operating systems & Components / Operating system package or component libswscale5_9-32bit-debuginfo Operating systems & Components / Operating system package or component libswresample3_9-32bit-debuginfo Operating systems & Components / Operating system package or component libswresample3_9-32bit Operating systems & Components / Operating system package or component libavdevice58_13-32bit Operating systems & Components / Operating system package or component libavfilter7_110-32bit Operating systems & Components / Operating system package or component libpostproc55_9-32bit Operating systems & Components / Operating system package or component libavutil56_70-32bit-debuginfo Operating systems & Components / Operating system package or component libavcodec58_134-32bit-debuginfo Operating systems & Components / Operating system package or component libswscale5_9-32bit Operating systems & Components / Operating system package or component libavresample4_0-32bit Operating systems & Components / Operating system package or component libavfilter7_110-32bit-debuginfo Operating systems & Components / Operating system package or component libavformat58_76-32bit Operating systems & Components / Operating system package or component libavutil56_70-32bit Operating systems & Components / Operating system package or component libavresample4_0-32bit-debuginfo Operating systems & Components / Operating system package or component libavdevice58_13-32bit-debuginfo Operating systems & Components / Operating system package or component libavcodec58_134-32bit Operating systems & Components / Operating system package or component libavfilter7_110 Operating systems & Components / Operating system package or component ffmpeg-4-libswresample-devel Operating systems & Components / Operating system package or component ffmpeg-4-debugsource Operating systems & Components / Operating system package or component ffmpeg-4-libavformat-devel Operating systems & Components / Operating system package or component ffmpeg-4-libavdevice-devel Operating systems & Components / Operating system package or component libavresample4_0-debuginfo Operating systems & Components / Operating system package or component libavdevice58_13-debuginfo Operating systems & Components / Operating system package or component libavutil56_70-debuginfo Operating systems & Components / Operating system package or component libswscale5_9 Operating systems & Components / Operating system package or component libpostproc55_9 Operating systems & Components / Operating system package or component libswscale5_9-debuginfo Operating systems & Components / Operating system package or component libswresample3_9-debuginfo Operating systems & Components / Operating system package or component libavcodec58_134-debuginfo Operating systems & Components / Operating system package or component libavcodec58_134 Operating systems & Components / Operating system package or component ffmpeg-4-libavcodec-devel Operating systems & Components / Operating system package or component ffmpeg-4-libavfilter-devel Operating systems & Components / Operating system package or component ffmpeg-4-libswscale-devel Operating systems & Components / Operating system package or component libavutil56_70 Operating systems & Components / Operating system package or component libavdevice58_13 Operating systems & Components / Operating system package or component ffmpeg-4 Operating systems & Components / Operating system package or component libavformat58_76 Operating systems & Components / Operating system package or component libavresample4_0 Operating systems & Components / Operating system package or component libavfilter7_110-debuginfo Operating systems & Components / Operating system package or component ffmpeg-4-private-devel Operating systems & Components / Operating system package or component ffmpeg-4-libavutil-devel Operating systems & Components / Operating system package or component ffmpeg-4-libavresample-devel Operating systems & Components / Operating system package or component libpostproc55_9-debuginfo Operating systems & Components / Operating system package or component ffmpeg-4-libpostproc-devel Operating systems & Components / Operating system package or component libavformat58_76-debuginfo Operating systems & Components / Operating system package or component ffmpeg-4-debuginfo Operating systems & Components / Operating system package or component libswresample3_9 Operating systems & Components / Operating system package or component
Vendor	SUSE

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Buffer overflow

EUVDB-ID: #VU89310

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-51798

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to a boundary error in libavfilter/vf_minterpolate.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and perform a denial of service (DoS) attack.

Mitigation

Update the affected package ffmpeg-4 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Workstation Extension 15: SP6

SUSE Package Hub 15: 15-SP6

SUSE Linux Enterprise Real Time 15: SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

SUSE Linux Enterprise Desktop 15: SP6

libavdevice58_13-64bit-debuginfo: before 4.4-150600.13.10.1

libavutil56_70-64bit-debuginfo: before 4.4-150600.13.10.1

libswresample3_9-64bit: before 4.4-150600.13.10.1

libpostproc55_9-64bit: before 4.4-150600.13.10.1

libavutil56_70-64bit: before 4.4-150600.13.10.1

libavformat58_76-64bit-debuginfo: before 4.4-150600.13.10.1

libavcodec58_134-64bit-debuginfo: before 4.4-150600.13.10.1

libswscale5_9-64bit: before 4.4-150600.13.10.1

libswresample3_9-64bit-debuginfo: before 4.4-150600.13.10.1

libavcodec58_134-64bit: before 4.4-150600.13.10.1

libavfilter7_110-64bit: before 4.4-150600.13.10.1

libavformat58_76-64bit: before 4.4-150600.13.10.1

libavdevice58_13-64bit: before 4.4-150600.13.10.1

libswscale5_9-64bit-debuginfo: before 4.4-150600.13.10.1

libpostproc55_9-64bit-debuginfo: before 4.4-150600.13.10.1

libavresample4_0-64bit: before 4.4-150600.13.10.1

libavresample4_0-64bit-debuginfo: before 4.4-150600.13.10.1

libavfilter7_110-64bit-debuginfo: before 4.4-150600.13.10.1

libavformat58_76-32bit-debuginfo: before 4.4-150600.13.10.1

libpostproc55_9-32bit-debuginfo: before 4.4-150600.13.10.1

libswscale5_9-32bit-debuginfo: before 4.4-150600.13.10.1

libswresample3_9-32bit-debuginfo: before 4.4-150600.13.10.1

libswresample3_9-32bit: before 4.4-150600.13.10.1

libavdevice58_13-32bit: before 4.4-150600.13.10.1

libavfilter7_110-32bit: before 4.4-150600.13.10.1

libpostproc55_9-32bit: before 4.4-150600.13.10.1

libavutil56_70-32bit-debuginfo: before 4.4-150600.13.10.1

libavcodec58_134-32bit-debuginfo: before 4.4-150600.13.10.1

libswscale5_9-32bit: before 4.4-150600.13.10.1

libavresample4_0-32bit: before 4.4-150600.13.10.1

libavfilter7_110-32bit-debuginfo: before 4.4-150600.13.10.1

libavformat58_76-32bit: before 4.4-150600.13.10.1

libavutil56_70-32bit: before 4.4-150600.13.10.1

libavresample4_0-32bit-debuginfo: before 4.4-150600.13.10.1

libavdevice58_13-32bit-debuginfo: before 4.4-150600.13.10.1

libavcodec58_134-32bit: before 4.4-150600.13.10.1

libavfilter7_110: before 4.4-150600.13.10.1

ffmpeg-4-libswresample-devel: before 4.4-150600.13.10.1

ffmpeg-4-debugsource: before 4.4-150600.13.10.1

ffmpeg-4-libavformat-devel: before 4.4-150600.13.10.1

ffmpeg-4-libavdevice-devel: before 4.4-150600.13.10.1

libavresample4_0-debuginfo: before 4.4-150600.13.10.1

libavdevice58_13-debuginfo: before 4.4-150600.13.10.1

libavutil56_70-debuginfo: before 4.4-150600.13.10.1

libswscale5_9: before 4.4-150600.13.10.1

libpostproc55_9: before 4.4-150600.13.10.1

libswscale5_9-debuginfo: before 4.4-150600.13.10.1

libswresample3_9-debuginfo: before 4.4-150600.13.10.1

libavcodec58_134-debuginfo: before 4.4-150600.13.10.1

libavcodec58_134: before 4.4-150600.13.10.1

ffmpeg-4-libavcodec-devel: before 4.4-150600.13.10.1

ffmpeg-4-libavfilter-devel: before 4.4-150600.13.10.1

ffmpeg-4-libswscale-devel: before 4.4-150600.13.10.1

libavutil56_70: before 4.4-150600.13.10.1

libavdevice58_13: before 4.4-150600.13.10.1

ffmpeg-4: before 4.4-150600.13.10.1

libavformat58_76: before 4.4-150600.13.10.1

libavresample4_0: before 4.4-150600.13.10.1

libavfilter7_110-debuginfo: before 4.4-150600.13.10.1

ffmpeg-4-private-devel: before 4.4-150600.13.10.1

ffmpeg-4-libavutil-devel: before 4.4-150600.13.10.1

ffmpeg-4-libavresample-devel: before 4.4-150600.13.10.1

libpostproc55_9-debuginfo: before 4.4-150600.13.10.1

ffmpeg-4-libpostproc-devel: before 4.4-150600.13.10.1

libavformat58_76-debuginfo: before 4.4-150600.13.10.1

ffmpeg-4-debuginfo: before 4.4-150600.13.10.1

libswresample3_9: before 4.4-150600.13.10.1

CPE2.3

External links

http://www.suse.com/support/update/announcement/2024/suse-su-20242864-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU94649

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-32230