1. Ubuntu Security Notices
  2. USN-6803-1

USN-6803-1: FFmpeg vulnerabilities

Publication date

30 May 2024

Overview

FFmpeg could be made to crash or run programs as your login if it opened a specially crafted file.

Releases

Packages

  • ffmpeg - Tools for transcoding, streaming and playing of multimedia files

Details

Zeng Yunxiang and Song Jiaxuan discovered that FFmpeg incorrectly handled
certain input files. An attacker could possibly use this issue to cause
FFmpeg to crash, resulting in a denial of service, or potential arbitrary
code execution. This issue only affected Ubuntu 24.04 LTS. (CVE-2023-49501)

Zeng Yunxiang and Song Jiaxuan discovered that FFmpeg incorrectly handled
certain input files. An attacker could possibly use this issue to cause
FFmpeg to crash, resulting in a denial of service, or potential arbitrary
code execution. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.10 and Ubuntu 24.04 LTS.
(CVE-2023-49502)

Zhang Ling and Zeng Yunxiang discovered that FFmpeg incorrectly handled
certain input files. An attacker could possibly use this issue to cause
FFmpeg to crash, resulting in a denial of service, or...

Zeng Yunxiang and Song Jiaxuan discovered that FFmpeg incorrectly handled
certain input files. An attacker could possibly use this issue to cause
FFmpeg to crash, resulting in a denial of service, or potential arbitrary
code execution. This issue only affected Ubuntu 24.04 LTS. (CVE-2023-49501)

Zeng Yunxiang and Song Jiaxuan discovered that FFmpeg incorrectly handled
certain input files. An attacker could possibly use this issue to cause
FFmpeg to crash, resulting in a denial of service, or potential arbitrary
code execution. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.10 and Ubuntu 24.04 LTS.
(CVE-2023-49502)

Zhang Ling and Zeng Yunxiang discovered that FFmpeg incorrectly handled
certain input files. An attacker could possibly use this issue to cause
FFmpeg to crash, resulting in a denial of service, or potential arbitrary
code execution. This issue only affected Ubuntu 23.10 and
Ubuntu 24.04 LTS. (CVE-2023-49528)

Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input
files. An attacker could possibly use this issue to cause FFmpeg to crash,
resulting in a denial of service, or potential arbitrary code execution.
This issue only affected Ubuntu 23.10 and Ubuntu 24.04 LTS.
(CVE-2023-50007)

Zeng Yunxiang and Song Jiaxuan discovered that FFmpeg incorrectly handled
certain input files. An attacker could possibly use this issue to cause
FFmpeg to crash, resulting in a denial of service, or potential arbitrary
code execution. This issue only affected Ubuntu 23.10 and
Ubuntu 24.04 LTS. (CVE-2023-50008)

Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input
files. An attacker could possibly use this issue to cause FFmpeg to crash,
resulting in a denial of service, or potential arbitrary code execution.
This issue only affected Ubuntu 23.10. (CVE-2023-50009)

Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input
files. An attacker could possibly use this issue to cause FFmpeg to crash,
resulting in a denial of service, or potential arbitrary code execution.
This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-50010)

Zeng Yunxiang and Li Zeyuan discovered that FFmpeg incorrectly handled
certain input files. An attacker could possibly use this issue to cause
FFmpeg to crash, resulting in a denial of service, or potential arbitrary
code execution. This issue only affected Ubuntu 22.04 LTS and
Ubuntu 23.10. (CVE-2023-51793)

Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input
files. An attacker could possibly use this issue to cause FFmpeg to crash,
resulting in a denial of service, or potential arbitrary code execution.
This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-51794, CVE-2023-51798)

Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input
files. An attacker could possibly use this issue to cause FFmpeg to crash,
resulting in a denial of service, or potential arbitrary code execution.
This issue only affected Ubuntu 23.10. (CVE-2023-51795, CVE-2023-51796)

It was discovered that discovered that FFmpeg incorrectly handled certain
input files. An attacker could possibly use this issue to cause FFmpeg to
crash, resulting in a denial of service, or potential arbitrary code
execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, Ubuntu 23.10 and Ubuntu 24.04 LTS. (CVE-2024-31578)

It was discovered that discovered that FFmpeg incorrectly handled certain
input files. An attacker could possibly use this issue to cause FFmpeg to
crash, resulting in a denial of service, or potential arbitrary code
execution. This issue only affected Ubuntu 23.10 and Ubuntu 24.04 LTS.
(CVE-2024-31582)

It was discovered that discovered that FFmpeg incorrectly handled certain
input files. An attacker could possibly use this issue to cause FFmpeg to
crash, resulting in a denial of service, or potential arbitrary code
execution. This issue only affected Ubuntu 23.10. (CVE-2024-31585)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
24.04 noble ffmpeg –  7:6.1.1-3ubuntu5+esm1  
libavcodec-extra60 –  7:6.1.1-3ubuntu5+esm1  
libavcodec60 –  7:6.1.1-3ubuntu5+esm1  
libavdevice60 –  7:6.1.1-3ubuntu5+esm1  
libavfilter-extra9 –  7:6.1.1-3ubuntu5+esm1  
libavfilter9 –  7:6.1.1-3ubuntu5+esm1  
libavformat-extra60 –  7:6.1.1-3ubuntu5+esm1  
libavformat60 –  7:6.1.1-3ubuntu5+esm1  
libavutil58 –  7:6.1.1-3ubuntu5+esm1  
libpostproc57 –  7:6.1.1-3ubuntu5+esm1  
libswresample4 –  7:6.1.1-3ubuntu5+esm1  
libswscale7 –  7:6.1.1-3ubuntu5+esm1  
23.10 mantic ffmpeg –  7:6.0-6ubuntu1.1
libavcodec-extra60 –  7:6.0-6ubuntu1.1
libavcodec60 –  7:6.0-6ubuntu1.1
libavdevice60 –  7:6.0-6ubuntu1.1
libavfilter-extra9 –  7:6.0-6ubuntu1.1
libavfilter9 –  7:6.0-6ubuntu1.1
libavformat-extra60 –  7:6.0-6ubuntu1.1
libavformat60 –  7:6.0-6ubuntu1.1
libavutil58 –  7:6.0-6ubuntu1.1
libpostproc57 –  7:6.0-6ubuntu1.1
libswresample4 –  7:6.0-6ubuntu1.1
libswscale7 –  7:6.0-6ubuntu1.1
22.04 jammy ffmpeg –  7:4.4.2-0ubuntu0.22.04.1+esm4  
libavcodec-extra58 –  7:4.4.2-0ubuntu0.22.04.1+esm4  
libavcodec58 –  7:4.4.2-0ubuntu0.22.04.1+esm4  
libavdevice58 –  7:4.4.2-0ubuntu0.22.04.1+esm4  
libavfilter-extra7 –  7:4.4.2-0ubuntu0.22.04.1+esm4  
libavfilter7 –  7:4.4.2-0ubuntu0.22.04.1+esm4  
libavformat-extra –  7:4.4.2-0ubuntu0.22.04.1+esm4  
libavformat-extra58 –  7:4.4.2-0ubuntu0.22.04.1+esm4  
libavformat58 –  7:4.4.2-0ubuntu0.22.04.1+esm4  
libavutil56 –  7:4.4.2-0ubuntu0.22.04.1+esm4  
libpostproc55 –  7:4.4.2-0ubuntu0.22.04.1+esm4  
libswresample3 –  7:4.4.2-0ubuntu0.22.04.1+esm4  
libswscale5 –  7:4.4.2-0ubuntu0.22.04.1+esm4  
20.04 focal ffmpeg –  7:4.2.7-0ubuntu0.1+esm5  
libavcodec-extra58 –  7:4.2.7-0ubuntu0.1+esm5  
libavcodec58 –  7:4.2.7-0ubuntu0.1+esm5  
libavdevice58 –  7:4.2.7-0ubuntu0.1+esm5  
libavfilter-extra7 –  7:4.2.7-0ubuntu0.1+esm5  
libavfilter7 –  7:4.2.7-0ubuntu0.1+esm5  
libavformat58 –  7:4.2.7-0ubuntu0.1+esm5  
libavresample4 –  7:4.2.7-0ubuntu0.1+esm5  
libavutil56 –  7:4.2.7-0ubuntu0.1+esm5  
libpostproc55 –  7:4.2.7-0ubuntu0.1+esm5  
libswresample3 –  7:4.2.7-0ubuntu0.1+esm5  
libswscale5 –  7:4.2.7-0ubuntu0.1+esm5  
18.04 bionic ffmpeg –  7:3.4.11-0ubuntu0.1+esm5  
libavcodec-extra57 –  7:3.4.11-0ubuntu0.1+esm5  
libavcodec57 –  7:3.4.11-0ubuntu0.1+esm5  
libavdevice57 –  7:3.4.11-0ubuntu0.1+esm5  
libavfilter-extra6 –  7:3.4.11-0ubuntu0.1+esm5  
libavfilter6 –  7:3.4.11-0ubuntu0.1+esm5  
libavformat57 –  7:3.4.11-0ubuntu0.1+esm5  
libavresample3 –  7:3.4.11-0ubuntu0.1+esm5  
libavutil55 –  7:3.4.11-0ubuntu0.1+esm5  
libpostproc54 –  7:3.4.11-0ubuntu0.1+esm5  
libswresample2 –  7:3.4.11-0ubuntu0.1+esm5  
libswscale4 –  7:3.4.11-0ubuntu0.1+esm5  
16.04 xenial ffmpeg –  7:2.8.17-0ubuntu0.1+esm7  
libavcodec-ffmpeg-extra56 –  7:2.8.17-0ubuntu0.1+esm7  
libavcodec-ffmpeg56 –  7:2.8.17-0ubuntu0.1+esm7  
libavdevice-ffmpeg56 –  7:2.8.17-0ubuntu0.1+esm7  
libavfilter-ffmpeg5 –  7:2.8.17-0ubuntu0.1+esm7  
libavformat-ffmpeg56 –  7:2.8.17-0ubuntu0.1+esm7  
libavresample-ffmpeg2 –  7:2.8.17-0ubuntu0.1+esm7  
libavutil-ffmpeg54 –  7:2.8.17-0ubuntu0.1+esm7  
libpostproc-ffmpeg53 –  7:2.8.17-0ubuntu0.1+esm7  
libswresample-ffmpeg1 –  7:2.8.17-0ubuntu0.1+esm7  
libswscale-ffmpeg3 –  7:2.8.17-0ubuntu0.1+esm7  

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›