Ubuntu alert USN-8329-1 (ffmpeg)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8329-1] FFmpeg vulnerability
Date:
             
 
Thu, 28 May 2026 12:26:44 +0000
Message-ID:
             
 
<E1wSZoy-00065V-Me@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-8329-1
May 28, 2026

ffmpeg vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS

Summary:

FFmpeg could be made to crash if it received specially crafted input.

Software Description:
- ffmpeg: Tools for transcoding, streaming and playing of multimedia files

Details:

It was discovered that the FFmpeg CAF decoder incorrectly handled certain
file size calculations. An attacker could possibly use this issue to cause
FFmpeg to crash, resulting in a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
  ffmpeg                          7:6.1.1-3ubuntu5+esm8
                                  Available with Ubuntu Pro
  libavcodec-extra60              7:6.1.1-3ubuntu5+esm8
                                  Available with Ubuntu Pro
  libavcodec60                    7:6.1.1-3ubuntu5+esm8
                                  Available with Ubuntu Pro
  libavdevice60                   7:6.1.1-3ubuntu5+esm8
                                  Available with Ubuntu Pro
  libavfilter-extra9              7:6.1.1-3ubuntu5+esm8
                                  Available with Ubuntu Pro
  libavfilter9                    7:6.1.1-3ubuntu5+esm8
                                  Available with Ubuntu Pro
  libavformat-extra60             7:6.1.1-3ubuntu5+esm8
                                  Available with Ubuntu Pro
  libavformat60                   7:6.1.1-3ubuntu5+esm8
                                  Available with Ubuntu Pro
  libavutil58                     7:6.1.1-3ubuntu5+esm8
                                  Available with Ubuntu Pro
  libpostproc57                   7:6.1.1-3ubuntu5+esm8
                                  Available with Ubuntu Pro
  libswresample4                  7:6.1.1-3ubuntu5+esm8
                                  Available with Ubuntu Pro
  libswscale7                     7:6.1.1-3ubuntu5+esm8
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8329-1
  CVE-2024-36617


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmoYNEYACgkQcpJm3tlz
hgHwsQ/9GRg3BNcJCn45Rx3KrQuHDW73TfVJRps/YyNXdhmN1msnp4RwWoxVmsvg
YI1yoD9RHz3rfN8Y8uHtfNQTElJ9CAwWhyH1nMTcsytioplD9/4FDrk2qo8pyTem
WcXB8XjQ78nYtTHye+JHEAssmWIAuWl/HeSKyPeswJt0EMPqDI3snjM5ZE2Hfl44
XB0hTGnbEWSx+Gi5OIvdkGEC4kk7sAtwrg5+Lj5CkD7aX1SEXJjl2xsVsdeRoBKp
aF9Szux0yMGu6h2BN7PPLcdQCKWkdEEDIw1yp7BmJKbEQEbmlDkwOrAjjUxGbOXQ
cyljjzjIzRyzxLzShuKFx9fRvWIghvpbRBtOEYqmGaVAvpMBOMcKeEZ0W6zIwDaG
BIxQnPqf2g9NdcqEEM1nyxTG0CjcqvHXCGInw67XYIy0svr1dK+pMlz50m9AkgX3
dCxX+n0qUojJ+cRal6TTx2Ti0haMyuF7VguYOZ4Um031u4z8Ycp3YNTk/1CIW1C3
cFVVCGXAuHMJmXoQMGL2LaKNzjgm4YlR+SuYUZ3OCFgKof6DySoc7n2ZYSDCGj6l
kbGSjeGY+nEV3W/j2jY9ikGHHzEsE80SR1yKHxl/ZIuFoi/8sfIMRDgIkRJFHIhv
gSH3q38axk032R6P1WohC4/QaVdPWrpjJ+X5XsxJ0D4P3mHwtoo=
=7WBs
-----END PGP SIGNATURE-----