CVE-2023-39018: Code Injection
Withdrawn
This advisory has been withdrawn because it has been found to be disputed. Please see the issue here for more information.
Original Despcription
FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>. This vulnerability is exploited via passing an unchecked argument.
Other sources
FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple third parties because there are no realistic use cases in which FFmpeg.java uses untrusted input for the path of the executable file.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-39018?
The severity of CVE-2023-39018 is critical, with a severity value of 9.8.
What is the affected software of CVE-2023-39018?
The affected software of CVE-2023-39018 includes FFmpeg versions up to and including 0.7.0 and Bramp Ffmpeg-cli-wrapper version up to and including 0.7.0.
How can CVE-2023-39018 be exploited?
CVE-2023-39018 can be exploited by passing an unchecked argument, allowing code injection in the component net.bramp.ffmpeg.FFmpeg.<constructor>.
Is there a fix available for CVE-2023-39018?
At the moment, there doesn't seem to be a fix available for CVE-2023-39018. It is recommended to update to the latest version of FFmpeg and Bramp Ffmpeg-cli-wrapper when a fix is released.
Where can I find more information about CVE-2023-39018?
You can find more information about CVE-2023-39018 on the GitHub issue page: https://github.com/bramp/ffmpeg-cli-wrapper/issues/291.