{"id":"SUSE-SU-2025:1128-1","summary":"Security update for ffmpeg-4","details":"This update for ffmpeg-4 fixes the following issues: \n \n \n- CVE-2020-22037: Fixed unchecked return value of the init_vlc function (bsc#1186756) \n- CVE-2024-12361: Fixed null pointer dereference (bsc#1237358) \n- CVE-2024-35368: Fixed double free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c (bsc#1234028) \n- CVE-2024-36613: Fixed integer overflow in the DXA demuxer of the libavformat library (bsc#1235092) \n- CVE-2025-0518: Fixed memory leak due to unchecked sscanf return value (bsc#1236007) \n- CVE-2025-22919: Fixed denial of service (DoS) via opening a crafted AAC file (bsc#1237371) \n- CVE-2025-22921: Fixed segmentation violation in NULL pointer dereference via the component /libavcodec/jpeg2000dec.c (bsc#1237382) \n- CVE-2025-25473: Fixed memory leak in avformat_free_context() (bsc#1237351) \n \nOther fixes: \n \n- Build with SVT-AV1 3.0.0. \n \n- Update to release 4.4.5: \n* Adjust bconds to build the package in SLFO without xvidcore. \n* Add 0001-libavcodec-arm-mlpdsp_armv5te-fix-label-format-to-wo.patch (bsc#1229338) \n* Add ffmpeg-c99.patch so that the package conforms to the C99 standard and builds on i586 with GCC 14. \n* No longer build against libmfx; build against libvpl (bsc#1230983, bsc#1219494) \n* Drop libmfx dependency from our product (jira #PED-10024) \n* Update patch to build with glslang 14 \n* Disable vmaf integration as ffmpeg-4 cannot handle vmaf\u003e=3 \n* Copy codec list from ffmpeg-6 \n* Resolve build failure with binutils \u003e= 2.41. (bsc#1215945)\n\n- Update to version 4.4.4: \n * avcodec/012v: Order operations for odd size handling \n * avcodec/alsdec: The minimal block is at least 7 bits \n * avcodec/bink: \n - Avoid undefined out of array end pointers in \n binkb_decode_plane() \n - Fix off by 1 error in ref end \n * avcodec/eac3dec: avoid float noise in fixed mode addition to \n overflow \n * avcodec/eatgq: : Check index increments in tgq_decode_block() \n * avcodec/escape124: \n - Fix signdness of end of input check \n - Fix some return codes \n * avcodec/ffv1dec: \n - Check that num h/v slices is supported \n - Fail earlier if prior context is corrupted \n - Restructure slice coordinate reading a bit \n * avcodec/mjpegenc: take into account component count when \n writing the SOF header size \n * avcodec/mlpdec: Check max matrix instead of max channel in \n noise check \n * avcodec/motionpixels: Mask pixels to valid values \n * avcodec/mpeg12dec: Check input size \n * avcodec/nvenc: \n - Fix b-frame DTS behavior with fractional framerates \n - Fix vbv buffer size in cq mode \n * avcodec/pictordec: Remove mid exit branch \n * avcodec/pngdec: Check deloco index more exactly \n * avcodec/rpzaenc: stop accessing out of bounds frame \n * avcodec/scpr3: Check bx \n * avcodec/scpr: Test bx before use \n * avcodec/snowenc: Fix visual weight calculation \n * avcodec/speedhq: Check buf_size to be big enough for DC \n * avcodec/sunrast: Fix maplength check \n * avcodec/tests/snowenc: \n - Fix 2nd test \n - Return a failure if DWT/IDWT mismatches \n - Unbreak DWT tests \n * avcodec/tiff: Ignore tile_count \n * avcodec/utils: \n - Allocate a line more for VC1 and WMV3 \n - Ensure linesize for SVQ3 \n - Use 32pixel alignment for bink \n * avcodec/videodsp_template: Adjust pointers to avoid undefined \n pointer things \n * avcodec/vp3: Add missing check for av_malloc \n * avcodec/wavpack: \n - Avoid undefined shift in get_tail() \n - Check for end of input in wv_unpack_dsd_high() \n * avcodec/xpmdec: Check size before allocation to avoid \n truncation \n * avfilter/vf_untile: swap the chroma shift values used for plane \n offsets \n * avformat/id3v2: Check taglen in read_uslt() \n * avformat/mov: Check samplesize and offset to avoid integer \n overflow \n * avformat/mxfdec: Use 64bit in remainder \n * avformat/nutdec: Add check for avformat_new_stream \n * avformat/replaygain: avoid undefined / negative abs \n * swscale/input: Use more unsigned intermediates \n * swscale/output: Bias 16bps output calculations to improve non \n overflowing range \n * swscale: aarch64: Fix yuv2rgb with negative stride \n * Use https for repository links \n \n- Update to version 4.4.3: \n * Stable bug fix release, mainly codecs, filter and format fixes. \n\n- Add patch to detect SDL2 \u003e= 2.1.0 (bsc#1202848): \n\n- Update to version 4.4.2: \n * Stable bug fix release, mainly codecs, filter and format fixes. \n\n- Add conflicts for ffmpeg-5's tools \n- Enable Vulkan filters \n- Fix OS version check, so nvcodec is enabled for Leap too. \n- Disamble libsmbclient usage (can always be built with \n --with-smbclient): the usecase of ffmpeg directly accessing \n smb:// shares is quite constructed (most users will have their \n smb shares mounted). \n\n- Update to version 4.4.1: \n * Stable bug fix release, mainly codecs and format fixes. \n\n","modified":"2026-02-04T04:37:33.481469Z","published":"2025-04-03T11:54:05Z","related":["CVE-2020-22037","CVE-2024-12361","CVE-2024-35368","CVE-2024-36613","CVE-2025-0518","CVE-2025-22919","CVE-2025-22921","CVE-2025-25473"],"upstream":["CVE-2020-22037","CVE-2024-12361","CVE-2024-35368","CVE-2024-36613","CVE-2025-0518","CVE-2025-22919","CVE-2025-22921","CVE-2025-25473"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251128-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1186756"},{"type":"REPORT","url":"https://bugzilla.suse.com/1202848"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215945"},{"type":"REPORT","url":"https://bugzilla.suse.com/1219494"},{"type":"REPORT","url":"https://bugzilla.suse.com/1229338"},{"type":"REPORT","url":"https://bugzilla.suse.com/1230983"},{"type":"REPORT","url":"https://bugzilla.suse.com/1234028"},{"type":"REPORT","url":"https://bugzilla.suse.com/1235092"},{"type":"REPORT","url":"https://bugzilla.suse.com/1236007"},{"type":"REPORT","url":"https://bugzilla.suse.com/1237351"},{"type":"REPORT","url":"https://bugzilla.suse.com/1237358"},{"type":"REPORT","url":"https://bugzilla.suse.com/1237371"},{"type":"REPORT","url":"https://bugzilla.suse.com/1237382"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2020-22037"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-12361"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-35368"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-36613"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-0518"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-22919"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-22921"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-25473"}],"affected":[{"package":{"name":"ffmpeg-4","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","purl":"pkg:rpm/suse/ffmpeg-4&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.5-150400.3.46.1"}]}],"ecosystem_specific":{"binaries":[{"libavcodec58_134":"4.4.5-150400.3.46.1","libavformat58_76":"4.4.5-150400.3.46.1","libavutil56_70":"4.4.5-150400.3.46.1","libpostproc55_9":"4.4.5-150400.3.46.1","libswresample3_9":"4.4.5-150400.3.46.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:1128-1.json"}},{"package":{"name":"ffmpeg-4","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","purl":"pkg:rpm/suse/ffmpeg-4&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.5-150400.3.46.1"}]}],"ecosystem_specific":{"binaries":[{"libpostproc55_9":"4.4.5-150400.3.46.1","libswresample3_9":"4.4.5-150400.3.46.1","libavcodec58_134":"4.4.5-150400.3.46.1","libavformat58_76":"4.4.5-150400.3.46.1","libavutil56_70":"4.4.5-150400.3.46.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:1128-1.json"}},{"package":{"name":"ffmpeg-4","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","purl":"pkg:rpm/suse/ffmpeg-4&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.5-150400.3.46.1"}]}],"ecosystem_specific":{"binaries":[{"libavcodec58_134":"4.4.5-150400.3.46.1","libavformat58_76":"4.4.5-150400.3.46.1","libavutil56_70":"4.4.5-150400.3.46.1","libpostproc55_9":"4.4.5-150400.3.46.1","libswresample3_9":"4.4.5-150400.3.46.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:1128-1.json"}},{"package":{"name":"ffmpeg-4","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","purl":"pkg:rpm/suse/ffmpeg-4&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.5-150400.3.46.1"}]}],"ecosystem_specific":{"binaries":[{"libavcodec58_134":"4.4.5-150400.3.46.1","libavformat58_76":"4.4.5-150400.3.46.1","libavutil56_70":"4.4.5-150400.3.46.1","libpostproc55_9":"4.4.5-150400.3.46.1","libswresample3_9":"4.4.5-150400.3.46.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:1128-1.json"}}],"schema_version":"1.7.3"}