CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

CVE details

CVE-2024-7055

A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651.

Score
6.9 medium
Published
2024-08-06
Links
NVD · cve.org

Affected ports (1)

PortPackageVersionStatusMaintainer
multimedia/ffmpeg3ffmpeg33.0.2_1unaddressedkreinholz@gmail.com

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>ffmpeg3</name>
	<range><lt>4.3.8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A vulnerability was found in FFmpeg up to 7.0.1. It has been
	classified as critical. This affects the function pnm_decode_frame in
	the library /libavcodec/pnmdec.c. The manipulation leads to heap-based
	buffer overflow. It is possible to initiate the attack remotely. The
	exploit has been disclosed to the public and may be used. Upgrading to
	version 7.0.2 is able to address this issue. It is recommended to
	upgrade the affected component. The associated identifier of this
	vulnerability is VDB-273651.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2024-7055</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2024-7055</url>
    </references>
    <dates>
      <discovery>2024-08-06</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>