Bug 2331079 (CVE-2024-12361)

Summary: CVE-2024-12361 ffmeg: FFmpeg NULL Pointer Dereference
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: dominik, prodsec-dev
Target Milestone: ---Keywords: Security
Target Release: ---Flags: dominik: needinfo? (prodsec-dev)
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2331081, 2331082, 2331083, 2331084, 2331080, 2331085, 2331086, 2331087, 2331088, 2331089, 2331090    
Bug Blocks:    

Description OSIDB Bzimport 2024-12-09 06:39:03 UTC 
An issue was discovered in FFmpeg through version 7.1, where the ff_mpv_encode_picture() function in libavcodec/mpegvideo_enc.c does not check the return value of av_packet_new_side_data(), leading to a null pointer dereference.
Comment 2 Dominik 'Rathann' Mierzejewski 2025-03-07 01:41:46 UTC 
Looks like the CVE ID is not published, only reserved and there's very limited information about the vulnerability.

https://access.redhat.com/security/cve/CVE-2024-12361 returns 404.

Can you provide more details or a link to upstream trac ticket?
Comment 3 Dominik 'Rathann' Mierzejewski 2025-03-07 01:47:41 UTC 
It also looks like this was fixed in 4065ff69a2ed49872f8694a03d0642b18c9d977c , which is included in 7.1, so I think the description is wrong.

7.0.2 and 6.1.2 remain vulnerable. I haven't checked older branches.