CVE-2022-1475

Publication date 2 May 2022

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

5.5 · Medium

Score breakdown

An integer overflow vulnerability was found in FFmpeg versions before 4.4.2 and before 5.0.1 in g729_parse() in llibavcodec/g729_parser.c when processing a specially crafted file.

Read the notes from the security team

Status

Package Ubuntu Release Status
ffmpeg 22.04 LTS jammy
Fixed 7:4.4.2-0ubuntu0.22.04.1
21.10 impish
Fixed 7:4.4.2-0ubuntu0.21.10.1
20.04 LTS focal
Not affected
18.04 LTS bionic
Not affected
16.04 LTS xenial
Not affected

Notes

rodrigo-zaiden

the vulnerability was added in version 4.2, in commit: https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=641d5215

Severity score breakdown

Parameter Value
Base score 5.5 · Medium
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact High
Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H