mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-07-29 05:56:59 +00:00
129 lines
5.5 KiB
JSON
129 lines
5.5 KiB
JSON
{
|
|
"data_version": "4.0",
|
|
"data_type": "CVE",
|
|
"data_format": "MITRE",
|
|
"CVE_data_meta": {
|
|
"ID": "CVE-2024-7272",
|
|
"ASSIGNER": "cna@vuldb.com",
|
|
"STATE": "PUBLIC"
|
|
},
|
|
"description": {
|
|
"description_data": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5. This affects the function fill_audiodata of the file /libswresample/swresample.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. This issue was fixed in version 6.0 by 9903ba28c28ab18dc7b7b6fb8571cc8b5caae1a6 but a backport for 5.1 was forgotten. The exploit has been disclosed to the public and may be used. Upgrading to version 5.1.6 and 6.0 9903ba28c28ab18dc7b7b6fb8571cc8b5caae1a6 is able to address this issue. It is recommended to upgrade the affected component."
|
|
},
|
|
{
|
|
"lang": "deu",
|
|
"value": "Es wurde eine kritische Schwachstelle in FFmpeg bis 5.1.5 gefunden. Es betrifft die Funktion fill_audiodata der Datei /libswresample/swresample.c. Dank Manipulation mit unbekannten Daten kann eine heap-based buffer overflow-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Ein Aktualisieren auf die Version 5.1.6 and 6.0 9903ba28c28ab18dc7b7b6fb8571cc8b5caae1a6 vermag dieses Problem zu l\u00f6sen. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
|
|
}
|
|
]
|
|
},
|
|
"problemtype": {
|
|
"problemtype_data": [
|
|
{
|
|
"description": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "CWE-122 Heap-based Buffer Overflow",
|
|
"cweId": "CWE-122"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"affects": {
|
|
"vendor": {
|
|
"vendor_data": [
|
|
{
|
|
"vendor_name": "n/a",
|
|
"product": {
|
|
"product_data": [
|
|
{
|
|
"product_name": "FFmpeg",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_affected": "=",
|
|
"version_value": "5.1.0"
|
|
},
|
|
{
|
|
"version_affected": "=",
|
|
"version_value": "5.1.1"
|
|
},
|
|
{
|
|
"version_affected": "=",
|
|
"version_value": "5.1.2"
|
|
},
|
|
{
|
|
"version_affected": "=",
|
|
"version_value": "5.1.3"
|
|
},
|
|
{
|
|
"version_affected": "=",
|
|
"version_value": "5.1.4"
|
|
},
|
|
{
|
|
"version_affected": "=",
|
|
"version_value": "5.1.5"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"references": {
|
|
"reference_data": [
|
|
{
|
|
"url": "https://vuldb.com/?id.273945",
|
|
"refsource": "MISC",
|
|
"name": "https://vuldb.com/?id.273945"
|
|
},
|
|
{
|
|
"url": "https://vuldb.com/?ctiid.273945",
|
|
"refsource": "MISC",
|
|
"name": "https://vuldb.com/?ctiid.273945"
|
|
},
|
|
{
|
|
"url": "https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc5",
|
|
"refsource": "MISC",
|
|
"name": "https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc5"
|
|
},
|
|
{
|
|
"url": "https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc6",
|
|
"refsource": "MISC",
|
|
"name": "https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc6"
|
|
},
|
|
{
|
|
"url": "https://ffmpeg.org/",
|
|
"refsource": "MISC",
|
|
"name": "https://ffmpeg.org/"
|
|
}
|
|
]
|
|
},
|
|
"impact": {
|
|
"cvss": [
|
|
{
|
|
"version": "3.1",
|
|
"baseScore": 6.3,
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
|
|
"baseSeverity": "MEDIUM"
|
|
},
|
|
{
|
|
"version": "3.0",
|
|
"baseScore": 6.3,
|
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
|
|
"baseSeverity": "MEDIUM"
|
|
},
|
|
{
|
|
"version": "2.0",
|
|
"baseScore": 7.5,
|
|
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
|
|
}
|
|
]
|
|
}
|
|
} |