FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code execution.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead
    to remote code execution. (CVE-2021-30123)

  - FFmpeg 4.2 is affected by null pointer dereference passed as argument to libavformat/aviobuf.c, which
    could cause a Denial of Service. (CVE-2020-20450)

  - Buffer Overflow vulnerability exists in FFmpeg 4.1 via apng_do_inverse_blend in libavcodec/pngenc.c, which
    could let a remote malicious user cause a Denial of Service (CVE-2020-21041)

  - A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the
    ff_v4l2_m2m_create_context function in v4l2_m2m.c. (CVE-2020-22038)

  - A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak is affected by: memory leak in
    the link_filter_inouts function in libavfilter/graphparser.c. (CVE-2020-22042)

The remote host is affected by the vulnerability described in GLSA-202105-24 (FFmpeg: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FFmpeg. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file using FFmpeg, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
427162	Alpine: ffmpeg4: security update to 4.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
427162	Alpine: ffmpeg4: security update to 4.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404326	Alpine: multiple ffmpeg packages: security update to 4.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404326	Alpine: multiple ffmpeg packages: security update to 4.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
156993	GLSA-202105-24 : FFmpeg: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2021-30123

high

Tenable Plugins

high

high

high

high

high