#pixelsmash — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #pixelsmash, aggregated by home.social.
-
nice; the ffmpeg fix is being backported
https://security-tracker.debian.org/tracker/CVE-2026-8461
#PixelSmash #Debian #ffmpeg -
nice; the ffmpeg fix is being backported
https://security-tracker.debian.org/tracker/CVE-2026-8461
#PixelSmash #Debian #ffmpeg -
nice; the ffmpeg fix is being backported
https://security-tracker.debian.org/tracker/CVE-2026-8461
#PixelSmash #Debian #ffmpeg -
dont panic people. aslr is there to protect you, ffmpeg exploit only works without aslr. aslr is enabled by default on modern systems!
to check on linux:
cat /proc/sys/kernel/randomize_va_space
should be 2 (OK)
#ffmpeg #PixelSmash -
dont panic people. aslr is there to protect you, ffmpeg exploit only works without aslr. aslr is enabled by default on modern systems!
to check on linux:
cat /proc/sys/kernel/randomize_va_space
should be 2 (OK)
#ffmpeg #PixelSmash -
dont panic people. aslr is there to protect you, ffmpeg exploit only works without aslr. aslr is enabled by default on modern systems!
to check on linux:
cat /proc/sys/kernel/randomize_va_space
should be 2 (OK)
#ffmpeg #PixelSmash -
"If you provide a network-based service and explicitly disable standard security measures, people can remotely hack into your system!"
"If you post the location of your spare key online, people from all over the country can come and rob your house!"
-
"If you provide a network-based service and explicitly disable standard security measures, people can remotely hack into your system!"
"If you post the location of your spare key online, people from all over the country can come and rob your house!"
-
"If you provide a network-based service and explicitly disable standard security measures, people can remotely hack into your system!"
"If you post the location of your spare key online, people from all over the country can come and rob your house!"
-
"If you provide a network-based service and explicitly disable standard security measures, people can remotely hack into your system!"
"If you post the location of your spare key online, people from all over the country can come and rob your house!"
-
"If you provide a network-based service and explicitly disable standard security measures, people can remotely hack into your system!"
"If you post the location of your spare key online, people from all over the country can come and rob your house!"
-
🚨 ‼️ Pixelfed + Loops Admins PSA ⚠️
You need to update ffmpeg to v8.1.2+ ASAP.
We made a guide for Ubuntu ⬇️
https://gist.github.com/dansup/460039bf77284752cbf5ca7d6406f6c4
Please boost for visibility, this also affects other fediverse software, and this guide may help those admins too.
See https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/ for more details about the vulnerability.
-
🚨 ‼️ Pixelfed + Loops Admins PSA ⚠️
You need to update ffmpeg to v8.1.2+ ASAP.
We made a guide for Ubuntu ⬇️
https://gist.github.com/dansup/460039bf77284752cbf5ca7d6406f6c4
Please boost for visibility, this also affects other fediverse software, and this guide may help those admins too.
See https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/ for more details about the vulnerability.
-
🚨 ‼️ Pixelfed + Loops Admins PSA ⚠️
You need to update ffmpeg to v8.1.2+ ASAP.
We made a guide for Ubuntu ⬇️
https://gist.github.com/dansup/460039bf77284752cbf5ca7d6406f6c4
Please boost for visibility, this also affects other fediverse software, and this guide may help those admins too.
See https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/ for more details about the vulnerability.
-
🚨 ‼️ Pixelfed + Loops Admins PSA ⚠️
You need to update ffmpeg to v8.1.2+ ASAP.
We made a guide for Ubuntu ⬇️
https://gist.github.com/dansup/460039bf77284752cbf5ca7d6406f6c4
Please boost for visibility, this also affects other fediverse software, and this guide may help those admins too.
See https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/ for more details about the vulnerability.
-
🚨 ‼️ Pixelfed + Loops Admins PSA ⚠️
You need to update ffmpeg to v8.1.2+ ASAP.
We made a guide for Ubuntu ⬇️
https://gist.github.com/dansup/460039bf77284752cbf5ca7d6406f6c4
Please boost for visibility, this also affects other fediverse software, and this guide may help those admins too.
See https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/ for more details about the vulnerability.
-
Hey, #mastoadmin, you _really_ want to update your system!
#pixelsmash #ffmpeg -
Hey, #mastoadmin, you _really_ want to update your system!
#pixelsmash #ffmpeg -
Hey, #mastoadmin, you _really_ want to update your system!
#pixelsmash #ffmpeg -
Hey, #mastoadmin, you _really_ want to update your system!
#pixelsmash #ffmpeg -
Hey, #mastoadmin, you _really_ want to update your system!
#pixelsmash #ffmpeg -
I feel like this is an under-reported limitation to that ffmpeg "PixelSmash" vulnerability: Their proof-of-concept exploit only works with ASLR disabled. Which, on any modern system, really shouldn't be the case.
https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/
-
I feel like this is an under-reported limitation to that ffmpeg "PixelSmash" vulnerability: Their proof-of-concept exploit only works with ASLR disabled. Which, on any modern system, really shouldn't be the case.
https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/
-
I feel like this is an under-reported limitation to that ffmpeg "PixelSmash" vulnerability: Their proof-of-concept exploit only works with ASLR disabled. Which, on any modern system, really shouldn't be the case.
https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/
-
I feel like this is an under-reported limitation to that ffmpeg "PixelSmash" vulnerability: Their proof-of-concept exploit only works with ASLR disabled. Which, on any modern system, really shouldn't be the case.
https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/
-
I feel like this is an under-reported limitation to that ffmpeg "PixelSmash" vulnerability: Their proof-of-concept exploit only works with ASLR disabled. Which, on any modern system, really shouldn't be the case.
https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/
-
I find it weird calling the recent FFmpeg security vulnerability a RCE [1]. Where is that remote coming from?
Yes sure, some web applications use FFmpeg and passes untrusted files to it. *Those* have a RCE.
Setting the CVSS attack vector to "network" seems overinflating.By that standard any software that somebody built a webapp around is "network" facing.
And let's not even talk about setting attack complexity to "low" but admitting that it only works with ASLR disabled.
[1] https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/
-
I find it weird calling the recent FFmpeg security vulnerability a RCE [1]. Where is that remote coming from?
Yes sure, some web applications use FFmpeg and passes untrusted files to it. *Those* have a RCE.
Setting the CVSS attack vector to "network" seems overinflating.By that standard any software that somebody built a webapp around is "network" facing.
And let's not even talk about setting attack complexity to "low" but admitting that it only works with ASLR disabled.
[1] https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/
-
I find it weird calling the recent FFmpeg security vulnerability a RCE [1]. Where is that remote coming from?
Yes sure, some web applications use FFmpeg and passes untrusted files to it. *Those* have a RCE.
Setting the CVSS attack vector to "network" seems overinflating.By that standard any software that somebody built a webapp around is "network" facing.
And let's not even talk about setting attack complexity to "low" but admitting that it only works with ASLR disabled.
[1] https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/
-
I find it weird calling the recent FFmpeg security vulnerability a RCE [1]. Where is that remote coming from?
Yes sure, some web applications use FFmpeg and passes untrusted files to it. *Those* have a RCE.
Setting the CVSS attack vector to "network" seems overinflating.By that standard any software that somebody built a webapp around is "network" facing.
And let's not even talk about setting attack complexity to "low" but admitting that it only works with ASLR disabled.
[1] https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/
-
I find it weird calling the recent FFmpeg security vulnerability a RCE [1]. Where is that remote coming from?
Yes sure, some web applications use FFmpeg and passes untrusted files to it. *Those* have a RCE.
Setting the CVSS attack vector to "network" seems overinflating.By that standard any software that somebody built a webapp around is "network" facing.
And let's not even talk about setting attack complexity to "low" but admitting that it only works with ASLR disabled.
[1] https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/
