Vulnerability · Published Apr 19, 2024 · Assigned by mitre
CVE-2023-50009
High 8.0
In plain English
A high-severity heap buffer overflow in the ffmpeg package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.0High
Exploit odds (30 days)0.4%top 61.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow via the ff_gaussian_blur_8 function in libavfilter/edge_template.c:116:5 component.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | ffmpeg | 7:7.0.1-3 | DEBIAN-CVE-2023-50009 |
| Debian:14 | ffmpeg | 7:7.0.1-3 | DEBIAN-CVE-2023-50009 |
Affected products (as reported)
Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
References
- https://github.com/FFmpeg/FFmpeg
- https://trac.ffmpeg.org/ticket/10699
- https://ffmpeg.org/
- FEDORA-2024-92780a83f9 vendor-advisory
- FEDORA-2024-55e7e839f1 vendor-advisory
- FEDORA-2024-3a548f46a8 vendor-advisory
- https://github.com/FFmpeg/FFmpeg/commit/162b4c60c8f72be2e93b759f3b1e14652b70b3ba
- https://github.com/FFmpeg/FFmpeg/commit/c443658d26d2b8e19901f9507a890e0efca79056
- FEDORA-2024-92780a83f9 vendor-advisory, x_transferred
- FEDORA-2024-55e7e839f1 vendor-advisory, x_transferred
- FEDORA-2024-3a548f46a8 vendor-advisory, x_transferred