USN-6449-2: ffmpeg Ubuntu
CVSS: UnknownPublished
Published 15-11-2023Last modified 22-04-2026
Vulnerability summary
USN-6449-2 is a vulnerability in ffmpeg Ubuntu with no CVSS score yet.
CVSS score
Not scored
010
No CVSS score recordedEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 15-11-2023PublishedVulnerability first disclosed.
- 22-04-2026Last modifiedVulnerability information updated.
Description
ffmpeg regression USN-6449-1 fixed vulnerabilities in FFmpeg. Unfortunately that update could introduce a regression in tools using an FFmpeg library, like VLC. This updated fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that FFmpeg incorrectly managed memory resulting in a memory leak. An attacker could possibly use this issue to cause a denial of service via application crash. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-22038) It was discovered that FFmpeg incorrectly handled certain input files, leading to an integer overflow. An attacker could possibly use this issue to cause a denial of service via application crash. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-20898, CVE-2021-38090, CVE-2021-38091, CVE-2021-38092, CVE-2021-38093, CVE-2021-38094) It was discovered that FFmpeg incorrectly managed memory, resulting in a memory leak. If a user or automated system were tricked into processing a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. (CVE-2022-48434)
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu1 product
- ffmpeg< 7:3.4.11-0ubuntu0.1+esm4 | < 7:4.2.7-0ubuntu0.1+esm4 | < 7:4.4.2-0ubuntu0.22.04.1+esm3
1 vendor · 1 product
References
2 linksRelated vulnerabilities
USN-7823-1ubuntuffmpegffmpeg vulnerabilities
It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected
Ubuntu 24.04 LTS. (CVE-2024-35365)
It was discovered that FFmpeg did not correctly handle certain integer
calculations. An attacker could possibly use this issue to cause a denial
of service. (CVE-2024-35366)
It was discovered that FFmpeg may perform an out-of-bounds read under
certain circumstances. An attacker could possibly use this issue to cause
a denial of service. (CVE-2024-35367)
It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2024-35368)
It was discovered that FFmpeg did not correctly handle certain inputs,
which could lead to an integer overflow. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2024-36613, CVE-2024-36616, CVE-2024-36618)
It was discovered that FFmpeg did not correctly handle certain inputs,
which could lead to an integer overflow. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code. This
issue only affected Ubuntu 24.04 LTS. (CVE-2024-36619)
It was discovered that FFmpeg did not correctly handle certain memory
operations. A remote attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-7055)USN-6803-1ubuntuffmpegffmpeg vulnerabilities
Zeng Yunxiang and Song Jiaxuan discovered that FFmpeg incorrectly handled
certain input files. An attacker could possibly use this issue to cause
FFmpeg to crash, resulting in a denial of service, or potential arbitrary
code execution. This issue only affected Ubuntu 24.04 LTS. (CVE-2023-49501)
Zeng Yunxiang and Song Jiaxuan discovered that FFmpeg incorrectly handled
certain input files. An attacker could possibly use this issue to cause
FFmpeg to crash, resulting in a denial of service, or potential arbitrary
code execution. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.10 and Ubuntu 24.04 LTS.
(CVE-2023-49502)
Zhang Ling and Zeng Yunxiang discovered that FFmpeg incorrectly handled
certain input files. An attacker could possibly use this issue to cause
FFmpeg to crash, resulting in a denial of service, or potential arbitrary
code execution. This issue only affected Ubuntu 23.10 and
Ubuntu 24.04 LTS. (CVE-2023-49528)
Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input
files. An attacker could possibly use this issue to cause FFmpeg to crash,
resulting in a denial of service, or potential arbitrary code execution.
This issue only affected Ubuntu 23.10 and Ubuntu 24.04 LTS.
(CVE-2023-50007)
Zeng Yunxiang and Song Jiaxuan discovered that FFmpeg incorrectly handled
certain input files. An attacker could possibly use this issue to cause
FFmpeg to crash, resulting in a denial of service, or potential arbitrary
code execution. This issue only affected Ubuntu 23.10 and
Ubuntu 24.04 LTS. (CVE-2023-50008)
Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input
files. An attacker could possibly use this issue to cause FFmpeg to crash,
resulting in a denial of service, or potential arbitrary code execution.
This issue only affected Ubuntu 23.10. (CVE-2023-50009)
Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input
files. An attacker could possibly use this issue to cause FFmpeg to crash,
resulting in a denial of service, or potential arbitrary code execution.
This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-50010)
Zeng Yunxiang and Li Zeyuan discovered that FFmpeg incorrectly handled
certain input files. An attacker could possibly use this issue to cause
FFmpeg to crash, resulting in a denial of service, or potential arbitrary
code execution. This issue only affected Ubuntu 22.04 LTS and
Ubuntu 23.10. (CVE-2023-51793)
Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input
files. An attacker could possibly use this issue to cause FFmpeg to crash,
resulting in a denial of service, or potential arbitrary code execution.
This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-51794, CVE-2023-51798)
Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input
files. An attacker could possibly use this issue to cause FFmpeg to crash,
resulting in a denial of service, or potential arbitrary code execution.
This issue only affected Ubuntu 23.10. (CVE-2023-51795, CVE-2023-51796)
It was discovered that discovered that FFmpeg incorrectly handled certain
input files. An attacker could possibly use this issue to cause FFmpeg to
crash, resulting in a denial of service, or potential arbitrary code
execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, Ubuntu 23.10 and Ubuntu 24.04 LTS. (CVE-2024-31578)
It was discovered that discovered that FFmpeg incorrectly handled certain
input files. An attacker could possibly use this issue to cause FFmpeg to
crash, resulting in a denial of service, or potential arbitrary code
execution. This issue only affected Ubuntu 23.10 and Ubuntu 24.04 LTS.
(CVE-2024-31582)
It was discovered that discovered that FFmpeg incorrectly handled certain
input files. An attacker could possibly use this issue to cause FFmpeg to
crash, resulting in a denial of service, or potential arbitrary code
execution. This issue only affected Ubuntu 23.10. (CVE-2024-31585)USN-6430-1ubuntuffmpegffmpeg vulnerabilities
It was discovered that FFmpeg did not properly handle certain inputs in
vf_lagfun.c, resulting in a buffer overflow vulnerability. An attacker
could possibly use this issue to cause a denial of service via application
crash. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-22024)
It was discovered that FFmpeg incorrectly managed memory in avienc.c,
resulting in a memory leak. An attacker could possibly use this issue
to cause a denial of service via application crash. (CVE-2020-22039)
It was discovered that FFmpeg incorrectly handled certain files due to a
memory leak in frame.c. An attacker could possibly use this issue to cause
a denial of service via application crash. This issue affected
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-22040)
It was discovered that FFmpeg incorrectly handled certain files due to a
memory leak in fifo.c. An attacker could possibly use this issue to cause
a denial of service via application crash. (CVE-2020-22043)
It was discovered that FFmpeg incorrectly handled certain files due to a
memory leak in vf_tile.c. If a user or automated system were tricked into
processing a specially crafted MOV file, an attacker could possibly use
this issue to cause a denial of service. (CVE-2020-22051)
It was discovered that FFmpeg incorrectly handled certain MOV files in
timecode.c, leading to an integer overflow. An attacker could possibly
use this issue to cause a denial of service using a crafted MOV file.
This issue only affected Ubuntu 16.04 LTS. (CVE-2021-28429)USN-5958-1ubuntuffmpegffmpeg vulnerabilities
It was discovered that FFmpeg could be made to dereference a null
pointer. An attacker could possibly use this to cause a denial of
service via application crash. These issues only affected Ubuntu
16.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04
LTS. (CVE-2022-3109, CVE-2022-3341)
It was discovered that FFmpeg could be made to access an out-of-bounds
frame by the Apple RPZA encoder. An attacker could possibly use this
to cause a denial of service via application crash or access sensitive
information. This issue only affected Ubuntu 22.04 LTS and Ubuntu
22.10. (CVE-2022-3964)
It was discovered that FFmpeg could be made to access an out-of-bounds
frame by the QuickTime encoder. An attacker could possibly use this to
cause a denial of service via application crash or access sensitive
information. This issue only affected Ubuntu 22.10. (CVE-2022-3965)USN-5472-1ubuntuffmpegffmpeg vulnerabilities
It was discovered that FFmpeg would attempt to divide by zero when using Linear
Predictive Coding (LPC) or AAC codecs. An attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 21.10. (CVE-2020-20445, CVE-2020-20446,
CVE-2020-20453)
It was discovered that FFmpeg incorrectly handled certain input. An attacker
could possibly use this issue to cause a denial of service. This issue only
affected Ubuntu 20.04 LTS. (CVE-2020-20450)
It was discovered that FFmpeg incorrectly handled file conversion to APNG
format. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2020-21041)
It was discovered that FFmpeg incorrectly handled remuxing RTP-hint tracks.
A remote attacker could possibly use this issue to execute arbitrary code.
This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2020-21688)
It was discovered that FFmpeg incorrectly handled certain specially crafted
AVI files. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2020-21697)
It was discovered that FFmpeg incorrectly handled writing MOV video tags. An
attacker could possibly use this issue to cause a denial of service, obtain
sensitive information or execute arbitrary code. This issue only affected
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 21.10. (CVE-2020-22015)
It was discovered that FFmpeg incorrectly handled writing MOV files. An
attacker could possibly use this issue to cause a denial of service or other
unspecified impact. This issue affected only Ubuntu 18.04 LTS. (CVE-2020-22016)
It was discovered that FFmpeg incorrectly handled memory when using certain
filters. An attacker could possibly use this issue to cause a denial of service
or other unspecified impact. This issue only affected Ubuntu 18.04 LTS and
Ubuntu 20.04 LTS. (CVE-2020-22017, CVE-2020-22020, CVE-2020-22022,
CVE-2020-22023, CVE-2022-22025, CVE-2020-22026, CVE-2020-22028, CVE-2020-22031,
CVE-2020-22032, CVE-2020-22034, CVE-2020-22036, CVE-2020-22042)
It was discovered that FFmpeg incorrectly handled memory when using certain
filters. An attacker could possibly use this issue to cause a denial of service
or other unspecified impact. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 21.10. (CVE-2020-22019, CVE-2020-22021,
CVE-2020-22033)
It was discovered that FFmpeg incorrectly handled memory when using certain
filters. An attacker could possibly use this issue to cause a denial of service
or other unspecified impact. This issue only affected Ubuntu 21.10.
(CVE-2020-22027, CVE-2020-22029, CVE-2020-22030, CVE-2020-22035)
It was discovered that FFmpeg incorrectly handled certain specially crafted
JPEG files. An attacker could possibly use this issue to obtain sensitive
information. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and
Ubuntu 21.10. (CVE-2020-22037)
It was discovered that FFmpeg incorrectly performed calculations in EXR codec.
An attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-35965)
It was discovered that FFmpeg did not verify return values of functions
init_vlc and init_get_bits. An attacker could possibly use this issue to cause
a denial of service or other unspecified impact. This issue only affected
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 21.10. (CVE-2021-38114,
CVE-2021-38171)
It was discovered that FFmpeg incorrectly handled certain specially crafted
files. An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 21.10 and Ubuntu 22.04 LTS. (CVE-2022-1475)USN-5167-1ubuntuffmpegffmpeg vulnerabilities
It was discovered that FFmpeg did not properly verify certain input when
processing video and audio files. An attacker could possibly use this to send
specially crafted input to the application, force a division by zero, and
cause a denial of service (application crash). (CVE-2020-20445, CVE-2020-20446,
CVE-2020-20453, CVE-2020-20892)
It was discovered that FFmpeg did not properly perform certain bit shift and
memory operations. An attacker could possibly use this issue to expose
sensitive information. (CVE-2020-20902)
It was discovered that FFmpeg did not properly perform memory management
operations in various of its functions. An attacker could possibly use this
issue to send specially crafted input to the application and cause a denial of
service (application crash) or execute arbitrary code. (CVE-2020-21041,
CVE-2020-20451, CVE-2020-21688, CVE-2020-21697, CVE-2020-22020,
CVE-2020-22021, CVE-2020-22022, CVE-2020-22025, CVE-2020-22031,
CVE-2020-22032, CVE-2020-22037, CVE-2020-22040, CVE-2020-22041,
CVE-2020-22042, CVE-2020-22044)
It was discovered that FFmpeg did not properly perform memory management
operations in various of its functions. An attacker could possibly use this
issue to send specially crafted input to the application and cause a denial of
service (application crash) or execute arbitrary code. (CVE-2020-22016,
CVE-2020-22046, CVE-2020-22049, CVE-2020-22054)
It was discovered that FFmpeg did not properly perform memory management
operations in various of its functions. An attacker could possibly use this
issue to send specially crafted input to the application and cause a denial of
service (application crash) or execute arbitrary code. (CVE-2020-35965)
It was discovered that FFmpeg did not properly handle data assigned to the tty
demuxer. An attacker could possibly use this issue to send specially crafted
input to the application and expose sensitive information. (CVE-2021-3566)
It was discovered that FFmpeg did not perform checks on function return
values when encoding and formatting input video and audio files. An attacker
could possibly use this issue to cause a denial of service (application crash)
or execute arbitrary code. (CVE-2021-38114, CVE-2021-38171)
It was discovered that FFmpeg did not properly sanitize function returned data
when calculating frame duration values. An attacker could possibly use this
issue to cause an assertion failure and then cause a denial of service
(application crash). (CVE-2021-38291)