There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the
    function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The
    manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The
    exploit has been disclosed to the public and may be used. (CVE-2025-1594)

  - A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via
    improper parsing of non-TTY-compliant input files in HLS playlists. (CVE-2023-6602)

  - A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage
    consumption, potentially leading to degraded performance or denial of service via the demuxing of
    arbitrary data as XBIN-formatted data without proper format validation. (CVE-2023-6604)

  - A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests
    to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs.
    (CVE-2023-6605)

  - Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within
    an Executable. This vulnerability is associated with program files
    https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C . This issue affects FFmpeg: 7.1. Issue
    was fixed: https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a
    https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered
    by: Simcha Kosman (CVE-2025-0518)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using     subversion <2. When a STOR chunk is present, a subsequent FOBJ chunk will be saved in ctx->stored_frame.
    Stored frames can later be referenced by FTCH chunks. For files using subversion < 2, the undecoded frame     is stored, and decoded again when the FTCH chunks are parsed. However, in process_frame_obj if the frame     has an invalid size, there's an early return, with a value of 0. This causes the code in decode_frame to     still store the raw frame buffer into ctx->stored_frame. Leaving ctx->has_dimensions set to false. A     subsequent chunk with type FTCH would call process_ftch and decode that frame obj again, adding to the     top/left values and calling process_frame_obj again. Given that we never set ctx->have_dimensions before,     this time we set the dimensions, calling init_buffers, which can reallocate the buffer in     ctx->stored_frame, freeing the previous one. However, the GetByteContext object gb still holds a reference     to the old buffer. Finally, when the code tries to decode the frame, codecs that accept a GetByteContext     as a parameter will trigger a use-after-free read when using gb. GetByteContext is only used for reading     bytes, so at most one could read invalid data. There are no heap allocations between the free and when the     object is accessed. However, upon returning to process_ftch, the code restores the original values for     top/left in stored_frame, writing 4 bytes to the freed data at offset 6, potentially corrupting the     allocator's metadata. This issue can be triggered just by probing whether a file has the sanm format. We     recommend upgrading to version 8.0 or beyond. (CVE-2025-59734)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
436230	Alpine: multiple ffmpeg packages: security update to 8.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	12/4/2025	7/20/2026	high
436230	Alpine: multiple ffmpeg packages: security update to 8.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	12/4/2025	7/20/2026	high
269301	Linux Distros Unpatched Vulnerability : CVE-2025-59734	Nessus	Misc.	10/8/2025	3/1/2026	high

Detections

Analytics

Plugins Search

high

high

high