Ubuntu alert USN-7890-1 (ffmpeg)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-7890-1] FFmpeg vulnerability
Date:
             
 
Thu, 27 Nov 2025 08:49:32 +0000
Message-ID:
             
 
<E1vOXgy-0005Lo-CL@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-7890-1
November 26, 2025

ffmpeg vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 LTS

Summary:

FFmpeg could be made to crash if it opened a specially crafted file.

Software Description:
- ffmpeg: Tools for transcoding, streaming and playing of multimedia files

Details:

It was discovered that FFmpeg did not properly handle the parsing of
certain malformed HLS playlists. If a user were tricked into opening a
specially crafted HLS playlist, an attacker could possibly use this issue
to cause FFmpeg to crash, resulting in a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS
  ffmpeg                          7:2.8.17-0ubuntu0.1+esm13
                                  Available with Ubuntu Pro
  libavcodec-ffmpeg-extra56       7:2.8.17-0ubuntu0.1+esm13
                                  Available with Ubuntu Pro
  libavcodec-ffmpeg56             7:2.8.17-0ubuntu0.1+esm13
                                  Available with Ubuntu Pro
  libavdevice-ffmpeg56            7:2.8.17-0ubuntu0.1+esm13
                                  Available with Ubuntu Pro
  libavfilter-ffmpeg5             7:2.8.17-0ubuntu0.1+esm13
                                  Available with Ubuntu Pro
  libavformat-ffmpeg56            7:2.8.17-0ubuntu0.1+esm13
                                  Available with Ubuntu Pro
  libavutil-ffmpeg54              7:2.8.17-0ubuntu0.1+esm13
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7890-1
  CVE-2023-6603


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmkoEGAACgkQcpJm3tlz
hgESSxAAtJslzx3nCzVdqejdRIya7jhwWxTDFj+BYJrrRtT8kE+hNQgIRxYqo7Ld
hwcaFYuadcO/d67GQMNoSJ+ASWhJjaBtC1bCne0a44nHp1wDtYjrOsyUxBB2eaJi
JY+XGAX7qds+3ncVpHRQvSeVHBoo0fyTBDjp4L4TDXGOFBZPfn+Nb9jXMiW5Nnmb
yo8Q7epwA15iObCKQc5JaJupHJOHLCPOCOFfLCpVjNNRikP+ukRTGbH8c9TFxMK7
OzRpQWnUrWkiV+8S6aQ32PC8Gkz1nTSGKzibTbn+IdgQGwp8WfOxU/R+fKRaJ8VM
TkTz6rkM1/NhcmAt3mlMph/x0j3gmGmBRBA9hotKx/4VNrQGu7VcjfKj5YsLjemc
WKiHOrSWZ5V7ZKRUXaG7IQKQYWwbjBoZyP8az3SGsPnJZponmMFJYBWqioI4Tvv6
SWBZ8SodGlCng1Cv5EUq+Qs4WMJw+ZmTIcXp1kekSPGJNuxTuIgSeZ0SJYT05bxC
kWt/BDCOiq9WNZC2e7k0E5LETLYPtSud3bjpPhAObLuwNVBU58RG38/pyixE/eM6
z2TAb8gAof6SleNYb6OtrW/q50MSQfQm233W0JIvK4krgMmiT8jizxC95pRmmZNu
Go/ygYCB3e3breM7+Q0vM4scB7EpX6xNa/9+g8GQivfgh6NXd/U=
=tQB0
-----END PGP SIGNATURE-----