Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle. Changing version to 45.
Fixed in: 9.0: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c441711a343ccf50196c70a3f0b554b52f8d9de 8.1.3: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c26e3cd2f879dc7bea3d0ee00dc5353f7bc9842d NOT fixed in 7.1.x.
FEDORA-2026-3e109a0c85 (ffmpeg-8.1.3-1.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e109a0c85
FEDORA-2026-3e109a0c85 has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-3e109a0c85` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e109a0c85 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-3e109a0c85 (ffmpeg-8.1.3-1.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.