Skip to content

Commit b54235c

Browse files
jlsec-botmbauman
jlsec-bot
and
mbauman
authored
[create-pull-request] automated change (#177)
Co-authored-by: mbauman <[email protected]> Co-authored-by: Matt Bauman <[email protected]>
1 parent 006c833 commit b54235c

File tree

52 files changed

+1314
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+1314
-0
lines changed

‎advisories/published/2025/JLSEC-0000-mns4hxrfz-1ed562i.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
```toml
2+
schema_version = "1.7.3"
3+
id = "JLSEC-0000-mns4hxrfz-1ed562i"
4+
modified = 2025-10-18T14:07:17.039Z
5+
upstream = ["CVE-2019-1000016"]
6+
references = ["https://github.com/FFmpeg/FFmpeg/commit/b97a4b658814b2de8b9f2a3bce491c002d34de31#diff-cd7e24986650014d67f484f3ffceef3f", "https://github.com/FFmpeg/FFmpeg/commit/b97a4b658814b2de8b9f2a3bce491c002d34de31#diff-cd7e24986650014d67f484f3ffceef3f"]
7+
8+
[[affected]]
9+
pkg = "FFMPEG_jll"
10+
ranges = ["< 4.3.1+0"]
11+
12+
[[jlsec_sources]]
13+
id = "CVE-2019-1000016"
14+
imported = 2025-10-18T14:07:17.039Z
15+
modified = 2024-11-21T04:17:41.023Z
16+
published = 2019-02-04T21:29:01.283Z
17+
url = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2019-1000016"
18+
html_url = "https://nvd.nist.gov/vuln/detail/CVE-2019-1000016"
19+
```
20+
21+
# FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcode...
22+
23+
FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs_av1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in after commit b97a4b658814b2de8b9f2a3bce491c002d34de31.
24+

‎advisories/published/2025/JLSEC-0000-mns4hxrg2-rlr0m0.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
```toml
2+
schema_version = "1.7.3"
3+
id = "JLSEC-0000-mns4hxrg2-rlr0m0"
4+
modified = 2025-10-18T14:07:17.042Z
5+
upstream = ["CVE-2019-9718"]
6+
references = ["http://www.securityfocus.com/bid/107382", "https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/1f00c97bc3475c477f3c468cf2d924d5761d0982", "https://github.com/FFmpeg/FFmpeg/commit/23ccf3cabb4baf6e8af4b1af3fcc59c904736f21", "https://seclists.org/bugtraq/2019/May/60", "https://usn.ubuntu.com/3967-1/", "https://www.debian.org/security/2019/dsa-4449", "http://www.securityfocus.com/bid/107382", "https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/1f00c97bc3475c477f3c468cf2d924d5761d0982", "https://github.com/FFmpeg/FFmpeg/commit/23ccf3cabb4baf6e8af4b1af3fcc59c904736f21", "https://seclists.org/bugtraq/2019/May/60", "https://usn.ubuntu.com/3967-1/", "https://www.debian.org/security/2019/dsa-4449"]
7+
8+
[[affected]]
9+
pkg = "FFMPEG_jll"
10+
ranges = ["< 4.3.1+0"]
11+
12+
[[jlsec_sources]]
13+
id = "CVE-2019-9718"
14+
imported = 2025-10-18T14:07:17.042Z
15+
modified = 2024-11-21T04:52:10.140Z
16+
published = 2019-03-12T09:29:00.530Z
17+
url = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2019-9718"
18+
html_url = "https://nvd.nist.gov/vuln/detail/CVE-2019-9718"
19+
```
20+
21+
# In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU v...
22+
23+
In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.
24+

‎advisories/published/2025/JLSEC-0000-mns4hxrg4-14nb37q.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
```toml
2+
schema_version = "1.7.3"
3+
id = "JLSEC-0000-mns4hxrg4-14nb37q"
4+
modified = 2025-10-18T14:07:17.044Z
5+
upstream = ["CVE-2019-9721"]
6+
references = ["http://www.securityfocus.com/bid/107384", "https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/894995c41e0795c7a44f81adc4838dedc3932e65", "https://github.com/FFmpeg/FFmpeg/commit/273f2755ce8635d42da3cde0eeba15b2e7842774", "https://usn.ubuntu.com/3967-1/", "http://www.securityfocus.com/bid/107384", "https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/894995c41e0795c7a44f81adc4838dedc3932e65", "https://github.com/FFmpeg/FFmpeg/commit/273f2755ce8635d42da3cde0eeba15b2e7842774", "https://usn.ubuntu.com/3967-1/"]
7+
8+
[[affected]]
9+
pkg = "FFMPEG_jll"
10+
ranges = ["< 4.3.1+0"]
11+
12+
[[jlsec_sources]]
13+
id = "CVE-2019-9721"
14+
imported = 2025-10-18T14:07:17.044Z
15+
modified = 2024-11-21T04:52:10.573Z
16+
published = 2019-03-12T09:29:00.577Z
17+
url = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2019-9721"
18+
html_url = "https://nvd.nist.gov/vuln/detail/CVE-2019-9721"
19+
```
20+
21+
# A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU vi...
22+
23+
A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handle_open_brace in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.
24+

‎advisories/published/2025/JLSEC-0000-mns4hxrg7-1c389b9.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
```toml
2+
schema_version = "1.7.3"
3+
id = "JLSEC-0000-mns4hxrg7-1c389b9"
4+
modified = 2025-10-18T14:07:17.047Z
5+
upstream = ["CVE-2019-11339"]
6+
references = ["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00012.html", "http://www.securityfocus.com/bid/108037", "https://github.com/FFmpeg/FFmpeg/commit/1f686d023b95219db933394a7704ad9aa5f01cbb", "https://github.com/FFmpeg/FFmpeg/commit/d227ed5d598340e719eff7156b1aa0a4469e9a6a", "https://usn.ubuntu.com/3967-1/", "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00012.html", "http://www.securityfocus.com/bid/108037", "https://github.com/FFmpeg/FFmpeg/commit/1f686d023b95219db933394a7704ad9aa5f01cbb", "https://github.com/FFmpeg/FFmpeg/commit/d227ed5d598340e719eff7156b1aa0a4469e9a6a", "https://usn.ubuntu.com/3967-1/"]
7+
8+
[[affected]]
9+
pkg = "FFMPEG_jll"
10+
ranges = ["< 4.3.1+0"]
11+
12+
[[jlsec_sources]]
13+
id = "CVE-2019-11339"
14+
imported = 2025-10-18T14:07:17.047Z
15+
modified = 2024-11-21T04:20:54.743Z
16+
published = 2019-04-19T00:29:00.293Z
17+
url = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2019-11339"
18+
html_url = "https://nvd.nist.gov/vuln/detail/CVE-2019-11339"
19+
```
20+
21+
# The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4...
22+
23+
The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data.
24+

‎advisories/published/2025/JLSEC-0000-mns4hxrgb-11tewt3.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
```toml
2+
schema_version = "1.7.3"
3+
id = "JLSEC-0000-mns4hxrgb-11tewt3"
4+
modified = 2025-10-18T14:07:17.051Z
5+
upstream = ["CVE-2019-15942"]
6+
references = ["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00012.html", "https://security.gentoo.org/glsa/202007-58", "https://trac.ffmpeg.org/ticket/8093", "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00012.html", "https://security.gentoo.org/glsa/202007-58", "https://trac.ffmpeg.org/ticket/8093"]
7+
8+
[[affected]]
9+
pkg = "FFMPEG_jll"
10+
ranges = ["< 4.3.1+0"]
11+
12+
[[jlsec_sources]]
13+
id = "CVE-2019-15942"
14+
imported = 2025-10-18T14:07:17.051Z
15+
modified = 2024-11-21T04:29:47.143Z
16+
published = 2019-09-05T16:15:12.027Z
17+
url = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2019-15942"
18+
html_url = "https://nvd.nist.gov/vuln/detail/CVE-2019-15942"
19+
```
20+
21+
# FFmpeg through 4.2 has a "Conditional jump or move depends on uninitialised value" issue in h2645_pa...
22+
23+
FFmpeg through 4.2 has a "Conditional jump or move depends on uninitialised value" issue in h2645_parse because alloc_rbsp_buffer in libavcodec/h2645_parse.c mishandles rbsp_buffer.
24+

‎advisories/published/2025/JLSEC-0000-mns4hxrgd-1g4l4tu.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
```toml
2+
schema_version = "1.7.3"
3+
id = "JLSEC-0000-mns4hxrgd-1g4l4tu"
4+
modified = 2025-10-18T14:07:17.053Z
5+
upstream = ["CVE-2019-17539"]
6+
references = ["https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15733", "https://github.com/FFmpeg/FFmpeg/commit/8df6884832ec413cf032dfaa45c23b1c7876670c", "https://lists.debian.org/debian-lts-announce/2021/01/msg00026.html", "https://security.gentoo.org/glsa/202003-65", "https://usn.ubuntu.com/4431-1/", "https://www.debian.org/security/2020/dsa-4722", "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15733", "https://github.com/FFmpeg/FFmpeg/commit/8df6884832ec413cf032dfaa45c23b1c7876670c", "https://lists.debian.org/debian-lts-announce/2021/01/msg00026.html", "https://security.gentoo.org/glsa/202003-65", "https://usn.ubuntu.com/4431-1/", "https://www.debian.org/security/2020/dsa-4722"]
7+
8+
[[affected]]
9+
pkg = "FFMPEG_jll"
10+
ranges = ["< 4.3.1+0"]
11+
12+
[[jlsec_sources]]
13+
id = "CVE-2019-17539"
14+
imported = 2025-10-18T14:07:17.053Z
15+
modified = 2024-11-21T04:32:28.873Z
16+
published = 2019-10-14T02:15:10.513Z
17+
url = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2019-17539"
18+
html_url = "https://nvd.nist.gov/vuln/detail/CVE-2019-17539"
19+
```
20+
21+
# In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and poss...
22+
23+
In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.
24+

‎advisories/published/2025/JLSEC-0000-mns4hxrgh-1ay9m4u.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
```toml
2+
schema_version = "1.7.3"
3+
id = "JLSEC-0000-mns4hxrgh-1ay9m4u"
4+
modified = 2025-10-18T14:07:17.057Z
5+
upstream = ["CVE-2019-17542"]
6+
references = ["https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15919", "https://github.com/FFmpeg/FFmpeg/commit/02f909dc24b1f05cfbba75077c7707b905e63cd2", "https://lists.debian.org/debian-lts-announce/2019/12/msg00003.html", "https://lists.debian.org/debian-lts-announce/2020/07/msg00022.html", "https://security.gentoo.org/glsa/202003-65", "https://usn.ubuntu.com/4431-1/", "https://www.debian.org/security/2020/dsa-4722", "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15919", "https://github.com/FFmpeg/FFmpeg/commit/02f909dc24b1f05cfbba75077c7707b905e63cd2", "https://lists.debian.org/debian-lts-announce/2019/12/msg00003.html", "https://lists.debian.org/debian-lts-announce/2020/07/msg00022.html", "https://security.gentoo.org/glsa/202003-65", "https://usn.ubuntu.com/4431-1/", "https://www.debian.org/security/2020/dsa-4722"]
7+
8+
[[affected]]
9+
pkg = "FFMPEG_jll"
10+
ranges = ["< 4.3.1+0"]
11+
12+
[[jlsec_sources]]
13+
id = "CVE-2019-17542"
14+
imported = 2025-10-18T14:07:17.057Z
15+
modified = 2024-11-21T04:32:29.313Z
16+
published = 2019-10-14T02:15:10.780Z
17+
url = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2019-17542"
18+
html_url = "https://nvd.nist.gov/vuln/detail/CVE-2019-17542"
19+
```
20+
21+
# FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array ac...
22+
23+
FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c.
24+

‎advisories/published/2025/JLSEC-0000-mns4hxrgm-15d5aox.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
```toml
2+
schema_version = "1.7.3"
3+
id = "JLSEC-0000-mns4hxrgm-15d5aox"
4+
modified = 2025-10-18T14:07:17.062Z
5+
upstream = ["CVE-2020-12284"]
6+
references = ["https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19734", "https://github.com/FFmpeg/FFmpeg/commit/1812352d767ccf5431aa440123e2e260a4db2726", "https://github.com/FFmpeg/FFmpeg/commit/a3a3730b5456ca00587455004d40c047f7b20a99", "https://security.gentoo.org/glsa/202007-58", "https://usn.ubuntu.com/4431-1/", "https://www.debian.org/security/2020/dsa-4722", "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19734", "https://github.com/FFmpeg/FFmpeg/commit/1812352d767ccf5431aa440123e2e260a4db2726", "https://github.com/FFmpeg/FFmpeg/commit/a3a3730b5456ca00587455004d40c047f7b20a99", "https://security.gentoo.org/glsa/202007-58", "https://usn.ubuntu.com/4431-1/", "https://www.debian.org/security/2020/dsa-4722"]
7+
8+
[[affected]]
9+
pkg = "FFMPEG_jll"
10+
ranges = ["< 4.3.1+0"]
11+
12+
[[jlsec_sources]]
13+
id = "CVE-2020-12284"
14+
imported = 2025-10-18T14:07:17.062Z
15+
modified = 2024-11-21T04:59:26.903Z
16+
published = 2020-04-28T06:15:10.777Z
17+
url = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2020-12284"
18+
html_url = "https://nvd.nist.gov/vuln/detail/CVE-2020-12284"
19+
```
20+
21+
# cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer ove...
22+
23+
cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.
24+

‎advisories/published/2025/JLSEC-0000-mns4hxrgo-178047n.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
```toml
2+
schema_version = "1.7.3"
3+
id = "JLSEC-0000-mns4hxrgo-178047n"
4+
modified = 2025-10-18T14:07:17.064Z
5+
upstream = ["CVE-2020-14212"]
6+
references = ["https://patchwork.ffmpeg.org/project/ffmpeg/list/?series=1463", "https://security.gentoo.org/glsa/202007-58", "https://trac.ffmpeg.org/ticket/8716", "https://patchwork.ffmpeg.org/project/ffmpeg/list/?series=1463", "https://security.gentoo.org/glsa/202007-58", "https://trac.ffmpeg.org/ticket/8716"]
7+
8+
[[affected]]
9+
pkg = "FFMPEG_jll"
10+
ranges = [">= 4.3.1+0, < 4.3.1+2"]
11+
12+
[[jlsec_sources]]
13+
id = "CVE-2020-14212"
14+
imported = 2025-10-18T14:07:17.064Z
15+
modified = 2024-11-21T05:02:52.750Z
16+
published = 2020-06-16T22:15:10.443Z
17+
url = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2020-14212"
18+
html_url = "https://nvd.nist.gov/vuln/detail/CVE-2020-14212"
19+
```
20+
21+
# FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because...
22+
23+
FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because dnn_backend_native.c calls ff_dnn_load_model_native and a certain index check is omitted.
24+

‎advisories/published/2025/JLSEC-0000-mns4hxrgp-1be807n.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
```toml
2+
schema_version = "1.7.3"
3+
id = "JLSEC-0000-mns4hxrgp-1be807n"
4+
modified = 2025-10-18T14:07:17.065Z
5+
upstream = ["CVE-2020-35964"]
6+
references = ["https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26622", "https://github.com/FFmpeg/FFmpeg/commit/27a99e2c7d450fef15594671eef4465c8a166bd7", "https://security.gentoo.org/glsa/202105-24", "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26622", "https://github.com/FFmpeg/FFmpeg/commit/27a99e2c7d450fef15594671eef4465c8a166bd7", "https://security.gentoo.org/glsa/202105-24"]
7+
8+
[[affected]]
9+
pkg = "FFMPEG_jll"
10+
ranges = [">= 4.3.1+2, < 4.4.0+0"]
11+
[[affected]]
12+
pkg = "FFplay_jll"
13+
ranges = ["< 4.4.4+0"]
14+
15+
[[jlsec_sources]]
16+
id = "CVE-2020-35964"
17+
imported = 2025-10-18T14:07:17.065Z
18+
modified = 2024-11-21T05:28:36.243Z
19+
published = 2021-01-03T19:15:11.720Z
20+
url = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2020-35964"
21+
html_url = "https://nvd.nist.gov/vuln/detail/CVE-2020-35964"
22+
```
23+
24+
# track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrec...
25+
26+
track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing.
27+

0 commit comments

Comments
 (0)