CVE-2022-3109: Null Pointer Dereference
[Suggested description] An issue was discovered in the FFmpeg through 3.0. vp3decodeframe in libavcodec/vp3.c lacks check of the return value of avmalloc() and will cause the null pointer dereference.
------------------------------------------
[VulnerabilityType Other] NULL Pointer Dereference
------------------------------------------
[Vendor of Product] the development group
------------------------------------------
[Affected Product Code Base] FFmpeg - 3.0
------------------------------------------
[Reference] https://github.com/FFmpeg/FFmpeg/commit/656cb0450aeb73b25d7d26980af342b37ac4c568
------------------------------------------
[Discoverer] Jiasheng Jiang
Other sources
An issue was discovered in the FFmpeg package, where vp3decodeframe in libavcodec/vp3.c lacks check of the return value of avmalloc() and will cause a null pointer dereference, impacting availability.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-3109?
CVE-2022-3109 is a vulnerability in the FFmpeg package that can cause a null pointer dereference, impacting availability.
How does CVE-2022-3109 impact availability?
CVE-2022-3109 can lead to a null pointer dereference, which can result in crashes or system instability.
What is the severity of CVE-2022-3109?
CVE-2022-3109 has a severity rating of 7.5, indicating a high severity.
How do I fix CVE-2022-3109?
To fix CVE-2022-3109, update the FFmpeg package to version 5.1 or higher.
Where can I find more information about CVE-2022-3109?
You can find more information about CVE-2022-3109 in the references provided: [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2153551), [GitHub](https://github.com/FFmpeg/FFmpeg/commit/656cb0450aeb73b25d7d26980af342b37ac4c568), [Debian mailing list](https://lists.debian.org/debian-lts-announce/2023/06/msg00016.html).