AI found 21 FFmpeg zero-days, some 20 years old; Chrome 149 patched 429 bugs, including 100+ critical/high flaws.
  • VibeSurgeon@piefed.socialEnglish
    391·
    il y a 30 jours

    Its not like its a system service that you can get ingress through…

    With a competently crafted payload, you could perhaps get in via someone’s transcoding pipeline.

    • greyscale@lemmy.grey.oooEnglish
      95·
      il y a 30 jours

      Does nobody isolate ffmpeg and friends from their application?

      I can’t imagine you’d have much fun breaking into a container that terminates the moment the original ffmpeg stops, or over-runs its max execution time…

        • Passerby6497@lemmy.worldEnglish
          5·
          il y a 30 jours

          If you’re running rootless containers, it’s less of a concern. I’m trying to move all of my public containers to podman for this reason

      • VibeSurgeon@piefed.socialEnglish
        1·
        il y a 29 jours

        Sure, you’d need a second exploit to escalate from there.

        ffmpeg is expected to run for extended periods of time, given its use in transcoding.