ArchLinux: 202103-7: ffmpeg: arbitrary code execution
Summary
track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing. The issue is fixed in FFmpeg version 4.3.2.
Resolution
Upgrade to 2:4.3.2-1.
# pacman -Syu "ffmpeg>=2:4.3.2-1"
The problem has been fixed upstream in version 4.3.2.
References
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26622 https://github.com/FFmpeg/FFmpeg/commit/4f0bdff292391cdb96b79b08c56533029166bdc8 https://security.archlinux.org/CVE-2020-35964
Workaround
None.