{"id":"CVE-2024-12361","aliases":["MGASA-2025-0114","SUSE-SU-2025:0862-1","SUSE-SU-2025:1128-1","SUSE-SU-2025:1450-1","openSUSE-SU-2025:14833-1","openSUSE-SU-2025:14834-1","openSUSE-SU-2025:15010-1"],"status":"published","title":"Updated ffmpeg packages fix security vulnerability","description":"FFmpeg NULL Pointer Dereference. (CVE-2024-12361)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-02-25T00:00:00Z","modified":"2026-04-16T04:44:28Z","fixes":[{"ecosystem":"Mageia:9","package":"ffmpeg","fixed_in":["5.1.6-1.5.mga9","5.1.6-1.5.mga9.tainted"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:9","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.6-1.5.mga9"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.6-1.5.mga9.tainted"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.5-150600.13.16.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.5-150600.13.16.1"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.5-150600.13.16.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.5-150400.3.46.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.5-150400.3.46.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.5-150400.3.46.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.5-150400.3.46.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.5-3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1-3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.2-3.1"}]}],"bundled":14}],"references":[{"url":"https://advisories.mageia.org/MGASA-2025-0114.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34130","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJNUZFKKYTUNYVVV4IRSNIJAOCMVCKVS/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250862-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1202848","tags":["report"]},{"url":"https://bugzilla.suse.com/1215945","tags":["report"]},{"url":"https://bugzilla.suse.com/1223070","tags":["report"]},{"url":"https://bugzilla.suse.com/1223235","tags":["report"]},{"url":"https://bugzilla.suse.com/1223256","tags":["report"]},{"url":"https://bugzilla.suse.com/1223272","tags":["report"]},{"url":"https://bugzilla.suse.com/1223304","tags":["report"]},{"url":"https://bugzilla.suse.com/1223437","tags":["report"]},{"url":"https://bugzilla.suse.com/1227296","tags":["report"]},{"url":"https://bugzilla.suse.com/1229026","tags":["report"]},{"url":"https://bugzilla.suse.com/1229338","tags":["report"]},{"url":"https://bugzilla.suse.com/1234028","tags":["report"]},{"url":"https://bugzilla.suse.com/1235092","tags":["report"]},{"url":"https://bugzilla.suse.com/1236007","tags":["report"]},{"url":"https://bugzilla.suse.com/1237351","tags":["report"]},{"url":"https://bugzilla.suse.com/1237358","tags":["report"]},{"url":"https://bugzilla.suse.com/1237371","tags":["report"]},{"url":"https://bugzilla.suse.com/1237382","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-51793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-51794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-51798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25473","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251128-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1186756","tags":["report"]},{"url":"https://bugzilla.suse.com/1219494","tags":["report"]},{"url":"https://bugzilla.suse.com/1230983","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-22037","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251450-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1235091","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35365","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ISSVSDO2JTI2A2BSBS3A32J3AYUZWLOZ/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G5BFJ3U3RQS5BEVWWNUO24FHCSLCALHX/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22920","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VRV2HFFHZK4M5WT2N2QVH4SDEORPP6SK/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48368","tags":["web"]}],"sources":{"osv":[{"id":"MGASA-2025-0114","title":"Updated ffmpeg packages fix security vulnerability","description":"FFmpeg NULL Pointer Dereference. (CVE-2024-12361)\n","status":"published","published":"2025-03-26T03:43:25Z","modified":"2026-04-16T04:44:28.345591185Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:14833-1","title":"ffmpeg-4-4.4.5-3.1 on GA media","description":"These are all security issues fixed in the ffmpeg-4-4.4.5-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-02-25T00:00:00Z","modified":"2026-02-04T03:33:16.165871Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:14834-1","title":"ffmpeg-7-7.1-3.1 on GA media","description":"These are all security issues fixed in the ffmpeg-7-7.1-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-02-25T00:00:00Z","modified":"2026-02-04T03:18:14.061141Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15010-1","title":"ffmpeg-6-6.1.2-3.1 on GA media","description":"These are all security issues fixed in the ffmpeg-6-6.1.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-18T00:00:00Z","modified":"2026-02-04T02:59:23.876109Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:0862-1","title":"Security update for ffmpeg-4","description":"This update for ffmpeg-4 fixes the following issues:\n \n- CVE-2025-22921: Fixed segmentation violation in NULL pointer dereference via the component /libavcodec/jpeg2000dec.c (bsc#1237382).\n- CVE-2025-25473: Fixed memory leak in avformat_free_context() (bsc#1237351).\n- CVE-2025-0518: Fixed unchecked sscanf return value which leads to memory data leak (bsc#1236007).\n- CVE-2025-22919: Fixed denial of service (DoS) via opening a crafted AAC file (bsc#1237371).\n- CVE-2024-12361: Fixed NULL Pointer Dereference (bsc#1237358).\n- CVE-2024-35368: Fixed Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c (bsc#1234028).\n- CVE-2024-36613: Fixed Integer overflow in ffmpeg (bsc#1235092).\n- CVE-2023-50010: Fixed arbitrary code execution via the set_encoder_id function in /fftools/ffmpeg_enc.c component (bsc#1223256).\n- CVE-2023-51794: Fixed heap-buffer-overflow at libavfilter/af_stereowiden.c (bsc#1223437).\n- CVE-2023-51793: Fixed heap buffer overflow in the image_copy_plane function in libavutil/imgutils.c (bsc#1223272).\n- CVE-2023-49502: Fixed heap buffer overflow via the ff_bwdif_filter_intra_c function in libavfilter/bwdifdsp.c (bsc#1223235).\n- CVE-2023-51798: Fixed floating point exception(FPE) via the interpolate function in libavfilter/vf_minterpolate.c (bsc#1223304).\n- CVE-2024-31578: Fixed heap use-after-free via the av_hwframe_ctx_init function (bsc#1223070).\n- CVE-2024-7055: Fixed heap-based buffer overflow in pnmdec.c (bsc#1229026).\n- CVE-2024-32230: Fixed buffer overflow due to negative-size-param bug at libavcodec/mpegvideo_enc.c in load_input_picture (bsc#1227296).\n\nOther fixes:\n- Updated to version 4.4.5.\n ","status":"published","published":"2025-03-14T08:45:30Z","modified":"2026-02-04T02:54:29.454882Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:1128-1","title":"Security update for ffmpeg-4","description":"This update for ffmpeg-4 fixes the following issues: \n \n \n- CVE-2020-22037: Fixed unchecked return value of the init_vlc function (bsc#1186756) \n- CVE-2024-12361: Fixed null pointer dereference (bsc#1237358) \n- CVE-2024-35368: Fixed double free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c (bsc#1234028) \n- CVE-2024-36613: Fixed integer overflow in the DXA demuxer of the libavformat library (bsc#1235092) \n- CVE-2025-0518: Fixed memory leak due to unchecked sscanf return value (bsc#1236007) \n- CVE-2025-22919: Fixed denial of service (DoS) via opening a crafted AAC file (bsc#1237371) \n- CVE-2025-22921: Fixed segmentation violation in NULL pointer dereference via the component /libavcodec/jpeg2000dec.c (bsc#1237382) \n- CVE-2025-25473: Fixed memory leak in avformat_free_context() (bsc#1237351) \n \nOther fixes: \n \n- Build with SVT-AV1 3.0.0. \n \n- Update to release 4.4.5: \n* Adjust bconds to build the package in SLFO without xvidcore. \n* Add 0001-libavcodec-arm-mlpdsp_armv5te-fix-label-format-to-wo.patch (bsc#1229338) \n* Add ffmpeg-c99.patch so that the package conforms to the C99 standard and builds on i586 with GCC 14. \n* No longer build against libmfx; build against libvpl (bsc#1230983, bsc#1219494) \n* Drop libmfx dependency from our product (jira #PED-10024) \n* Update patch to build with glslang 14 \n* Disable vmaf integration as ffmpeg-4 cannot handle vmaf\u003e=3 \n* Copy codec list from ffmpeg-6 \n* Resolve build failure with binutils \u003e= 2.41. (bsc#1215945)\n\n- Update to version 4.4.4: \n * avcodec/012v: Order operations for odd size handling \n * avcodec/alsdec: The minimal block is at least 7 bits \n * avcodec/bink: \n - Avoid undefined out of array end pointers in \n binkb_decode_plane() \n - Fix off by 1 error in ref end \n * avcodec/eac3dec: avoid float noise in fixed mode addition to \n overflow \n * avcodec/eatgq: : Check index increments in tgq_decode_block() \n * avcodec/escape124: \n - Fix signdness of end of input check \n - Fix some return codes \n * avcodec/ffv1dec: \n - Check that num h/v slices is supported \n - Fail earlier if prior context is corrupted \n - Restructure slice coordinate reading a bit \n * avcodec/mjpegenc: take into account component count when \n writing the SOF header size \n * avcodec/mlpdec: Check max matrix instead of max channel in \n noise check \n * avcodec/motionpixels: Mask pixels to valid values \n * avcodec/mpeg12dec: Check input size \n * avcodec/nvenc: \n - Fix b-frame DTS behavior with fractional framerates \n - Fix vbv buffer size in cq mode \n * avcodec/pictordec: Remove mid exit branch \n * avcodec/pngdec: Check deloco index more exactly \n * avcodec/rpzaenc: stop accessing out of bounds frame \n * avcodec/scpr3: Check bx \n * avcodec/scpr: Test bx before use \n * avcodec/snowenc: Fix visual weight calculation \n * avcodec/speedhq: Check buf_size to be big enough for DC \n * avcodec/sunrast: Fix maplength check \n * avcodec/tests/snowenc: \n - Fix 2nd test \n - Return a failure if DWT/IDWT mismatches \n - Unbreak DWT tests \n * avcodec/tiff: Ignore tile_count \n * avcodec/utils: \n - Allocate a line more for VC1 and WMV3 \n - Ensure linesize for SVQ3 \n - Use 32pixel alignment for bink \n * avcodec/videodsp_template: Adjust pointers to avoid undefined \n pointer things \n * avcodec/vp3: Add missing check for av_malloc \n * avcodec/wavpack: \n - Avoid undefined shift in get_tail() \n - Check for end of input in wv_unpack_dsd_high() \n * avcodec/xpmdec: Check size before allocation to avoid \n truncation \n * avfilter/vf_untile: swap the chroma shift values used for plane \n offsets \n * avformat/id3v2: Check taglen in read_uslt() \n * avformat/mov: Check samplesize and offset to avoid integer \n overflow \n * avformat/mxfdec: Use 64bit in remainder \n * avformat/nutdec: Add check for avformat_new_stream \n * avformat/replaygain: avoid undefined / negative abs \n * swscale/input: Use more unsigned intermediates \n * swscale/output: Bias 16bps output calculations to improve non \n overflowing range \n * swscale: aarch64: Fix yuv2rgb with negative stride \n * Use https for repository links \n \n- Update to version 4.4.3: \n * Stable bug fix release, mainly codecs, filter and format fixes. \n\n- Add patch to detect SDL2 \u003e= 2.1.0 (bsc#1202848): \n\n- Update to version 4.4.2: \n * Stable bug fix release, mainly codecs, filter and format fixes. \n\n- Add conflicts for ffmpeg-5's tools \n- Enable Vulkan filters \n- Fix OS version check, so nvcodec is enabled for Leap too. \n- Disamble libsmbclient usage (can always be built with \n --with-smbclient): the usecase of ffmpeg directly accessing \n smb:// shares is quite constructed (most users will have their \n smb shares mounted). \n\n- Update to version 4.4.1: \n * Stable bug fix release, mainly codecs and format fixes. \n\n","status":"published","published":"2025-04-03T11:54:05Z","modified":"2026-02-04T04:37:33.481469Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:1450-1","title":"Security update for ffmpeg","description":"This update for ffmpeg fixes the following issues:\n\n- CVE-2025-22921: Clear array length when freeing it. (bsc#1237382)\n- CVE-2025-0518: Fix memory data leak when use sscanf(). (bsc#1236007)\n- CVE-2025-22919: Check for valid sample rate, to fix the invalid sample rate \u003e= 0. (bsc#1237371)\n- CVE-2024-12361: Add check for av_packet_new_side_data() to avoid null pointer dereference if allocation fails. (bsc#1237358)\n- CVE-2024-36613: Adjust order of operations around block align. (bsc#1235092)\n- CVE-2024-35365: Fix double-free on error. (bsc#1235091)\n- CVE-2024-35368: Fix double-free on the AVFrame is unreferenced. (bsc#1234028)\n- CVE-2023-51793: Fix out of array access. (bsc#1223272).\n- CVE-2023-51793: Fixed a heap buffer overflow in the image_copy_plane function in libavutil/imgutils.c (bsc#1223272).\n","status":"published","published":"2025-05-05T07:42:43Z","modified":"2026-02-04T02:52:10.881255Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}