OESA-2025-1017

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1017
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2025-1017.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2025-1017
Upstream
Published
2025-01-10T13:00:19Z
Modified
2025-09-03T06:20:19.630231Z
Summary
ffmpeg security update
Details

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.(CVE-2024-35369)

FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition.(CVE-2024-36619)

Database specific 
{
    "severity": "Medium"
}
References

Affected packages

openEuler:24.03-LTS / ffmpeg

Package

Name
ffmpeg
Purl
pkg:rpm/openEuler/ffmpeg&distro=openEuler-24.03-LTS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.1.1-18.oe2403

Ecosystem specific 

{
    "x86_64": [
        "ffmpeg-6.1.1-18.oe2403.x86_64.rpm",
        "ffmpeg-debuginfo-6.1.1-18.oe2403.x86_64.rpm",
        "ffmpeg-debugsource-6.1.1-18.oe2403.x86_64.rpm",
        "ffmpeg-devel-6.1.1-18.oe2403.x86_64.rpm",
        "ffmpeg-libs-6.1.1-18.oe2403.x86_64.rpm",
        "libavdevice-6.1.1-18.oe2403.x86_64.rpm"
    ],
    "aarch64": [
        "ffmpeg-6.1.1-18.oe2403.aarch64.rpm",
        "ffmpeg-debuginfo-6.1.1-18.oe2403.aarch64.rpm",
        "ffmpeg-debugsource-6.1.1-18.oe2403.aarch64.rpm",
        "ffmpeg-devel-6.1.1-18.oe2403.aarch64.rpm",
        "ffmpeg-libs-6.1.1-18.oe2403.aarch64.rpm",
        "libavdevice-6.1.1-18.oe2403.aarch64.rpm"
    ],
    "src": [
        "ffmpeg-6.1.1-18.oe2403.src.rpm"
    ]
}