CVE-2024-12361

FFmpeg NULL Pointer Dereference. (CVE-2024-12361)

These are all security issues fixed in the ffmpeg-4-4.4.5-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ffmpeg-7-7.1-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ffmpeg-6-6.1.2-3.1 package on the GA media of openSUSE Tumbleweed.

This update for ffmpeg-4 fixes the following issues:

• CVE-2025-22921: Fixed segmentation violation in NULL pointer dereference via the component /libavcodec/jpeg2000dec.c (bsc#1237382).
• CVE-2025-25473: Fixed memory leak in avformat_free_context() (bsc#1237351).
• CVE-2025-0518: Fixed unchecked sscanf return value which leads to memory data leak (bsc#1236007).
• CVE-2025-22919: Fixed denial of service (DoS) via opening a crafted AAC file (bsc#1237371).
• CVE-2024-12361: Fixed NULL Pointer Dereference (bsc#1237358).
• CVE-2024-35368: Fixed Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c (bsc#1234028).
• CVE-2024-36613: Fixed Integer overflow in ffmpeg (bsc#1235092).
• CVE-2023-50010: Fixed arbitrary code execution via the set_encoder_id function in /fftools/ffmpeg_enc.c component (bsc#1223256).
• CVE-2023-51794: Fixed heap-buffer-overflow at libavfilter/af_stereowiden.c (bsc#1223437).
• CVE-2023-51793: Fixed heap buffer overflow in the image_copy_plane function in libavutil/imgutils.c (bsc#1223272).
• CVE-2023-49502: Fixed heap buffer overflow via the ff_bwdif_filter_intra_c function in libavfilter/bwdifdsp.c (bsc#1223235).
• CVE-2023-51798: Fixed floating point exception(FPE) via the interpolate function in libavfilter/vf_minterpolate.c (bsc#1223304).
• CVE-2024-31578: Fixed heap use-after-free via the av_hwframe_ctx_init function (bsc#1223070).
• CVE-2024-7055: Fixed heap-based buffer overflow in pnmdec.c (bsc#1229026).
• CVE-2024-32230: Fixed buffer overflow due to negative-size-param bug at libavcodec/mpegvideo_enc.c in load_input_picture (bsc#1227296).

Other fixes:

• Updated to version 4.4.5.

This update for ffmpeg-4 fixes the following issues:

• CVE-2020-22037: Fixed unchecked return value of the init_vlc function (bsc#1186756)
• CVE-2024-12361: Fixed null pointer dereference (bsc#1237358)
• CVE-2024-35368: Fixed double free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c (bsc#1234028)
• CVE-2024-36613: Fixed integer overflow in the DXA demuxer of the libavformat library (bsc#1235092)
• CVE-2025-0518: Fixed memory leak due to unchecked sscanf return value (bsc#1236007)
• CVE-2025-22919: Fixed denial of service (DoS) via opening a crafted AAC file (bsc#1237371)
• CVE-2025-22921: Fixed segmentation violation in NULL pointer dereference via the component /libavcodec/jpeg2000dec.c (bsc#1237382)
• CVE-2025-25473: Fixed memory leak in avformat_free_context() (bsc#1237351) …

This update for ffmpeg fixes the following issues:

• CVE-2025-22921: Clear array length when freeing it. (bsc#1237382)
• CVE-2025-0518: Fix memory data leak when use sscanf(). (bsc#1236007)
• CVE-2025-22919: Check for valid sample rate, to fix the invalid sample rate >= 0. (bsc#1237371)
• CVE-2024-12361: Add check for av_packet_new_side_data() to avoid null pointer dereference if allocation fails. (bsc#1237358)
• CVE-2024-36613: Adjust order of operations around block align. (bsc#1235092)
• CVE-2024-35365: Fix double-free on error. (bsc#1235091)
• CVE-2024-35368: Fix double-free on the AVFrame is unreferenced. (bsc#1234028)
• CVE-2023-51793: Fix out of array access. (bsc#1223272).
• CVE-2023-51793: Fixed a heap buffer overflow in the image_copy_plane function in libavutil/imgutils.c (bsc#1223272).