CVE-2022-48434
Summary
| CVE | CVE-2022-48434 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-03-29 17:15:00 UTC |
| Updated | 2023-12-23 12:15:00 UTC |
| Description | libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used). |
Risk And Classification
Problem Types: CWE-416
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| H26Forge: Exploiting Vulnerabilities in the H.264 Decoders of iOS, Firefox, VLC [pdf] | Hacker News | MISC | news.ycombinator.com | |
| [SECURITY] Fedora 37 Update: ffmpeg-5.1.3-1.fc37 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| git.ffmpeg.org Git - ffmpeg.git/commit | MISC | git.ffmpeg.org | |
| [SECURITY] Fedora 36 Update: ffmpeg-5.0.3-1.fc36 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| [SECURITY] Fedora 37 Update: ffmpeg-5.1.3-1.fc37 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| wrv.github.io/h26forge.pdf | MISC | wrv.github.io | |
| FFmpeg: Multiple Vulnerabilities (GLSA 202312-14) — Gentoo security | security.gentoo.org | ||
| [SECURITY] Fedora 36 Update: ffmpeg-5.0.3-1.fc36 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 184446 Debian Security Update for ffmpeg (CVE-2022-48434)
- 199856 Ubuntu Security Notification for FFmpeg Vulnerabilities (USN-6449-1)
- 283880 Fedora Security Update for ffmpeg (FEDORA-2023-32c3bbbbc9)
- 283930 Fedora Security Update for ffmpeg (FEDORA-2023-1e24db98a6)
- 710815 Gentoo Linux FFmpeg Multiple Vulnerabilities (GLSA 202312-14)
- 753965 SUSE Enterprise Linux Security Update for ffmpeg (SUSE-SU-2023:2108-1)
- 753966 SUSE Enterprise Linux Security Update for ffmpeg (SUSE-SU-2023:2115-1)