Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Ubuntu 20.04, 18.04, 16.04: USN-4431-1 Critical FFmpeg Issues

ubuntu
Calendar Grey July 22, 2020
Dist Ubuntu Esm H88
Vulnerabilities discovered in FFmpeg across various Ubuntu versions demand urgent patches to avert potential exploits.
Several security issues were fixed in FFmpeg.

Summary

Several security issues were fixed in FFmpeg.

Software Description:

- ffmpeg: Tools for transcoding, streaming and playing of multimedia files

Details:

It was discovered that FFmpeg incorrectly verified empty audio packets or

HEVC data. An attacker could possibly use this issue to cause a denial of

service via a crafted file. This issue only affected Ubuntu 16.04 LTS, as

it was already fixed in Ubuntu 18.04 LTS. For more information see:

https://ubuntu.com/security/notices/USN-3967-1

(CVE-2018-15822, CVE-2019-11338)

It was discovered that FFmpeg incorrectly handled sscanf failures. An

attacker could possibly use this issue to cause a denial of service or

other unspecified impact. This issue only affected Ubuntu 16.04 LTS and

Ubuntu 18.04 LTS. (CVE-2019-12730)

It was discovered that FFmpeg incorrectly handled certain WEBM files. An

attacker could possibly use this issue to obtain sensitive data or other

unspecified impact. This issue only affected Ubuntu 20.04 LTS.

(CVE-2019-13...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service software update Ubuntu data exposure ffmpeg

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
  ffmpeg                          7:4.2.4-1ubuntu0.1
  libavcodec-extra58              7:4.2.4-1ubuntu0.1
  libavcodec58                    7:4.2.4-1ubuntu0.1
  libavdevice58                   7:4.2.4-1ubuntu0.1
  libavfilter-extra7              7:4.2.4-1ubuntu0.1
  libavfilter7                    7:4.2.4-1ubuntu0.1
  libavformat58                   7:4.2.4-1ubuntu0.1
  libavresample4                  7:4.2.4-1ubuntu0.1
  libavutil56                     7:4.2.4-1ubuntu0.1
  libpostproc55                   7:4.2.4-1ubuntu0.1
  libswresample3                  7:4.2.4-1ubuntu0.1
  libswscale5                     7:4.2.4-1ubuntu0.1

Ubuntu 18.04 LTS:
  ffmpeg                          7:3.4.8-0ubuntu0.2
  libavcodec-extra57              7:3.4.8-0ubuntu0.2
  libavcodec57                    7:3.4.8-0ubuntu0.2
  libavdevice57                   7:3.4.8-0ubuntu0.2
  libavfilter-extra6              7:3.4.8-0ubuntu0.2
  libavfilter6                    7:3.4.8-0ubuntu0.2
  libavformat57                   7:3.4.8-0ubuntu0.2
  libavresample3                  7:3.4.8-0ubuntu0.2
  libavutil55                     7:3.4.8-0ubuntu0.2
  libpostproc54                   7:3.4.8-0ubuntu0.2
  libswresample2                  7:3.4.8-0ubuntu0.2
  libswscale4                     7:3.4.8-0ubuntu0.2

Ubuntu 16.04 LTS:
  ffmpeg                          7:2.8.17-0ubuntu0.1
  libavcodec-ffmpeg-extra56       7:2.8.17-0ubuntu0.1
  libavcodec-ffmpeg56             7:2.8.17-0ubuntu0.1
  libavdevice-ffmpeg56            7:2.8.17-0ubuntu0.1
  libavfilter-ffmpeg5             7:2.8.17-0ubuntu0.1
  libavformat-ffmpeg56            7:2.8.17-0ubuntu0.1
  libavresample-ffmpeg2           7:2.8.17-0ubuntu0.1
  libavutil-ffmpeg54              7:2.8.17-0ubuntu0.1
  libpostproc-ffmpeg53            7:2.8.17-0ubuntu0.1
  libswresample-ffmpeg1           7:2.8.17-0ubuntu0.1
  libswscale-ffmpeg3              7:2.8.17-0ubuntu0.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-4431-1

CVE-2018-15822, CVE-2019-11338, CVE-2019-12730, CVE-2019-13312,

CVE-2019-13390, CVE-2019-17539, CVE-2019-17542, CVE-2020-12284,

CVE-2020-13904

Severity
critical
Lowest
Low
Medium
High
Critical

July 22, 2020

Topics%20covered

Topics Covered

security advisory denial of service software update Ubuntu data exposure ffmpeg

Package Information

https://launchpad.net/ubuntu/+source/ffmpeg/7:4.2.4-1ubuntu0.1
https://launchpad.net/ubuntu/+source/ffmpeg/7:3.4.8-0ubuntu0.2
https://launchpad.net/ubuntu/+source/ffmpeg/7:2.8.17-0ubuntu0.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here