A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3454 advisory.

  - An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of     the return value of av_malloc() and will cause a null pointer dereference, impacting availability.
    (CVE-2022-3109)

  - A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of     libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of     avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.
    (CVE-2022-3341)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2115-1 advisory.

  - In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.
    (CVE-2019-13390)

  - A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of     libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of     avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.
    (CVE-2022-3341)

  - libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel     state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in     some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used).
    (CVE-2022-48434)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM / 22.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5958-1 advisory.

  - An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of     the return value of av_malloc() and will cause a null pointer dereference, impacting availability.
    (CVE-2022-3109)

  - A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of     libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of     avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.
    (CVE-2022-3341)

  - A vulnerability classified as problematic has been found in ffmpeg. This affects an unknown part of the     file libavcodec/rpzaenc.c of the component QuickTime RPZA Video Encoder. The manipulation of the argument     y_size leads to out-of-bounds read. It is possible to initiate the attack remotely. The name of the patch     is 92f9b28ed84a77138105475beba16c146bdaf984. It is recommended to apply a patch to fix this issue. The     associated identifier of this vulnerability is VDB-213543. (CVE-2022-3964)

  - A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function     smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The     manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely. The     name of the patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to fix     this issue. The identifier of this vulnerability is VDB-213544. (CVE-2022-3965)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0206-1 advisory.

  - In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.
    (CVE-2019-13390)

  - A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of     libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of     avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.
    (CVE-2022-3341)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0172-1 advisory.

  - A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of     libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of     avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.
    (CVE-2022-3341)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
177254	Debian DLA-3454-1 : ffmpeg - LTS security update	Nessus	Debian Local Security Checks	high
175160	SUSE SLES15 Security Update : ffmpeg (SUSE-SU-2023:2115-1)	Nessus	SuSE Local Security Checks	high
172614	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : FFmpeg vulnerabilities (USN-5958-1)	Nessus	Ubuntu Local Security Checks	high
170903	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : ffmpeg (SUSE-SU-2023:0206-1)	Nessus	SuSE Local Security Checks	medium
170717	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : ffmpeg-4 (SUSE-SU-2023:0172-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2022-3341

medium

Tenable Plugins

high

high

high

medium

medium