DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
ffmpeg: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-10-08
Ein Angreifer kann mehrere Schwachstellen in ffmpeg ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Daten zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.
01
beschreibt (9)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-107698US | medium5.4 | — | ||
FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without v… | ||||
| CVE-2026-107697US | medium4.3 | — | ||
FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playl… | ||||
| CVE-2026-107696US | medium6.5 | — | ||
FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers contro… | ||||
| CVE-2026-107695US | medium6.5 | — | ||
FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playl… | ||||
| CVE-2026-107678US | medium4.7 | — | ||
FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked… | ||||
| CVE-2026-107677US | medium4.7 | — | ||
FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media UR… | ||||
| CVE-2026-107676US | low3.3 | — | ||
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping… | ||||
| CVE-2026-107675US | medium5.9 | — | ||
FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Att… | ||||
| CVE-2026-107660US | medium4.8 | — | ||
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-ad… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- GitHub Advisory Database vom 2026-10-08external
- GitHub Advisory Database vom 2026-10-08external
- GitHub Advisory Database vom 2026-10-08external
- GitHub Advisory Database vom 2026-10-08external
- GitHub Advisory Database vom 2026-10-08external
- GitHub Advisory Database vom 2026-10-08external
- GitHub Advisory Database vom 2026-10-08external
- GitHub Advisory Database vom 2026-10-08external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan