Logo
componentffmpeg
Name
ffmpeg
Version
6.1.4-r2
Type
library
Description
-
Licenses
-
PURL
-
CPE
cpe:2.3:a:ffmpeg:ffmpeg:6.1.4:*:*:*:*:*:*:*

Other Versions#


Project
Branch
Version
openwrt-25.12
6.1.4-r1

Patches#


#
Title
Author
Resolve
1
avutil/tx: fix GCC memset warning
Rosen Penev <rosenp@gmail.com>
2
avfilter/af_channelsplit: fix mixed declaration and code
Marvin Scholz <epirat07@gmail.com>
3
avcodec/pcm-bluray/dvd: Use correct pointer types on BE
Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
4
libavcodec: fix -Wint-conversion in vulkan
Sam James <sam@gentoo.org>
5
avcodec/tiff: Suppress unused variable warnings
Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
6
vulkan_decode: fix the print format of VkDeviceSize
Jun Zhao <mypopydev@gmail.com>
7
avformat/file: guard fd_dup by FD_PROTOCOL or PIPE_PROTOCOL
Zhao Zhili <zhilizhao@tencent.com>
8
Patch #8
Unknown
9
avformat/rawdec: guard by CONFIG_DATA_DEMUXER
Rosen Penev <rosenp@gmail.com>
10
avcodec/tableprint_vlc: Unbreak hardcoded tables
Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
11
avcodec/dct: Make declarations and definitions match
Andreas Rheinhardt <andreas.rheinhardt@outlook.com>

Vulnerabilities#


Name
Analysis
Description
Exploitable
FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c.
Exploitable
A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
Exploitable
An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file.
Exploitable
An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
Exploitable
FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c.
Exploitable
FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c.
Exploitable
A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Exploitable
A vulnerability was found in FFmpeg up to 7.1. It has been rated as problematic. Affected by this issue is the function mov_read_trak of the file libavformat/mov.c of the component MOV Parser. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The patch is identified as 43be8d07281caca2e88bfd8ee2333633e1fb1a13. It is recommended to apply a patch to fix this issue.
Exploitable
A flaw was found in FFmpeg’s TensorFlow backend within the libavfilter/dnn_backend_tf.c source file. The issue occurs in the dnn_execute_model_tf() function, where a task object is freed multiple times in certain error-handling paths. This redundant memory deallocation can lead to a double-free condition, potentially causing FFmpeg or any application using it to crash when processing TensorFlow-based DNN models. This results in a denial-of-service scenario but does not allow arbitrary code execution under normal conditions.
Exploitable
A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.
Exploitable
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Exploitable
FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input.
Exploitable
FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function.
Exploitable
FFmpeg v.n6.1-3-g466799d4f5 allows a buffer over-read at ff_gradfun_blur_line_movdqa_sse2, as demonstrated by a call to the set_encoder_id function in /fftools/ffmpeg_enc.c component.
Exploitable
FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow via the ff_gaussian_blur_8 function in libavfilter/edge_template.c:116:5 component.
Exploitable
FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component.
Exploitable
FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component.
Exploitable
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component.