CVE-2022-3109: Null Pointer Dereference
[Suggested description] An issue was discovered in the FFmpeg through 3.0. vp3decodeframe in libavcodec/vp3.c lacks check of the return value of avmalloc() and will cause the null pointer dereference.
------------------------------------------
[VulnerabilityType Other] NULL Pointer Dereference
------------------------------------------
[Vendor of Product] the development group
------------------------------------------
[Affected Product Code Base] FFmpeg - 3.0
------------------------------------------
[Reference] https://github.com/FFmpeg/FFmpeg/commit/656cb0450aeb73b25d7d26980af342b37ac4c568
------------------------------------------
[Discoverer] Jiasheng Jiang
Other sources
An issue was discovered in the FFmpeg package, where vp3decodeframe in libavcodec/vp3.c lacks check of the return value of avmalloc() and will cause a null pointer dereference, impacting availability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/FFmpegto a version that resolves this vulnerability.Fixed in 5.1 - Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:5.1.9-0+deb12u1Fixed in 7:7.1.5-0+deb13u1Fixed in 7:9.0.2-4 - Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:5.1-1
Event History
Frequently Asked Questions
What is CVE-2022-3109?
CVE-2022-3109 is a vulnerability in the FFmpeg package that can cause a null pointer dereference, impacting availability.
How does CVE-2022-3109 impact availability?
CVE-2022-3109 can lead to a null pointer dereference, which can result in crashes or system instability.
What is the severity of CVE-2022-3109?
CVE-2022-3109 has a severity rating of 7.5, indicating a high severity.
How do I fix CVE-2022-3109?
To fix CVE-2022-3109, update the FFmpeg package to version 5.1 or higher.
Where can I find more information about CVE-2022-3109?
You can find more information about CVE-2022-3109 in the references provided: [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2153551), [GitHub](https://github.com/FFmpeg/FFmpeg/commit/656cb0450aeb73b25d7d26980af342b37ac4c568), [Debian mailing list](https://lists.debian.org/debian-lts-announce/2023/06/msg00016.html).