CVE-2023-50007: Buffer Overflow
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via theavsamplessetsilence function in thelibavutil/samplefmt.c:260:9 component.
Other sources
FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the avsamplessetsilence function in thelibavutil/samplefmt.c:260:9 component.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ffmpegto a version that resolves this vulnerability.Fixed in 7:6.0-6ubuntu1.1 - Upgrade
Upgrade
ubuntu/ffmpegto a version that resolves this vulnerability.Fixed in 7:6.1.1-3ubuntu5+ - Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:5.1.9-0+deb12u1Fixed in 7:7.1.5-0+deb13u1Fixed in 7:9.0.2-4 - Upgrade
Upgrade
alpine/ffmpegto a version that resolves this vulnerability.Fixed in 7.1.1-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50007?
CVE-2023-50007 is classified as a critical buffer overflow vulnerability that can lead to arbitrary code execution.
How do I fix CVE-2023-50007?
To mitigate CVE-2023-50007, update Ffmpeg to version 7:6.0-6ubuntu1.1 or later for Ubuntu systems.
In which software does CVE-2023-50007 exist?
CVE-2023-50007 exists in Ffmpeg versions prior to 7:6.0-6ubuntu1.1, 7:6.1.1-3ubuntu5+, and certain versions from Debian.
Who is affected by CVE-2023-50007?
Local attackers on systems running affected versions of Ffmpeg may exploit CVE-2023-50007 to execute arbitrary code.
What component is impacted by CVE-2023-50007?
CVE-2023-50007 specifically impacts the av_samples_set_silence function in the libavutil/samplefmt.c file.