Ubuntu update for ffmpeg

1) Buffer overflow

EUVDB-ID: #VU94649

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-32230

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the load_input_picture() function in libavcodec/mpegvideo_enc.c. A remote attacker can create a specially crafted media file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package ffmpeg to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 24.04

libavcodec-dev (Ubuntu package): before Ubuntu Pro

libswscale7 (Ubuntu package): before Ubuntu Pro

libswresample4 (Ubuntu package): before Ubuntu Pro

libpostproc57 (Ubuntu package): before Ubuntu Pro

libavutil58 (Ubuntu package): before Ubuntu Pro

libavformat60 (Ubuntu package): before Ubuntu Pro

libavformat-extra60 (Ubuntu package): before Ubuntu Pro

libavfilter9 (Ubuntu package): before Ubuntu Pro

libavfilter-extra9 (Ubuntu package): before Ubuntu Pro

libavdevice60 (Ubuntu package): before Ubuntu Pro

libavcodec60 (Ubuntu package): before Ubuntu Pro

libavcodec-extra60 (Ubuntu package): before Ubuntu Pro

libavdevice-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libav-tools (Ubuntu package): before Ubuntu Pro

libavutil-ffmpeg54 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg-extra56 (Ubuntu package): before Ubuntu Pro

libavformat-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libavcodec-ffmpeg56 (Ubuntu package): before Ubuntu Pro

libpostproc-ffmpeg53 (Ubuntu package): before Ubuntu Pro

libavfilter-ffmpeg5 (Ubuntu package): before Ubuntu Pro

libswscale-ffmpeg3 (Ubuntu package): before Ubuntu Pro

libavresample-ffmpeg2 (Ubuntu package): before Ubuntu Pro

libswresample-ffmpeg1 (Ubuntu package): before Ubuntu Pro

libavcodec57 (Ubuntu package): before Ubuntu Pro

libavcodec-extra57 (Ubuntu package): before Ubuntu Pro

libavfilter6 (Ubuntu package): before Ubuntu Pro

libavfilter-extra6 (Ubuntu package): before Ubuntu Pro

libavformat57 (Ubuntu package): before Ubuntu Pro

libavdevice57 (Ubuntu package): before Ubuntu Pro

libpostproc54 (Ubuntu package): before Ubuntu Pro

libswscale4 (Ubuntu package): before Ubuntu Pro

libswresample2 (Ubuntu package): before Ubuntu Pro

libavresample3 (Ubuntu package): before Ubuntu Pro

libavutil55 (Ubuntu package): before Ubuntu Pro

libavresample4 (Ubuntu package): before Ubuntu Pro

libavcodec58 (Ubuntu package): before Ubuntu Pro

libavfilter7 (Ubuntu package): before Ubuntu Pro

libavutil56 (Ubuntu package): before Ubuntu Pro

libavfilter-extra7 (Ubuntu package): before Ubuntu Pro

libavcodec-extra58 (Ubuntu package): before Ubuntu Pro

libavformat-extra58 (Ubuntu package): before Ubuntu Pro

libavdevice58 (Ubuntu package): before Ubuntu Pro

libswscale5 (Ubuntu package): before Ubuntu Pro

libswresample3 (Ubuntu package): before Ubuntu Pro

libpostproc55 (Ubuntu package): before Ubuntu Pro

libavformat58 (Ubuntu package): before Ubuntu Pro

ffmpeg (Ubuntu package): before Ubuntu Pro

CPE2.3

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:18.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:16.04:*:*:*:*:*:*:

External links

http://ubuntu.com/security/notices/USN-6983-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.