In FFmpeg 4.0.1, due to a missing check of a profile value before setting it, the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg4Upgrade ffmpeg | Aug 30, 2018 | Jul 5, 2018 |
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Jul 5, 2018 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.1Upgrade to FFmpeg version 4.0.2 | Jul 19, 2018 | Jul 5, 2018 |
| Suse | — | Upgrade libswscale4Upgrade libavcodec-develUpgrade libpostproc54Upgrade libavformat-develUpgrade libswresample-develUpgrade libavutil-develUpgrade libavutil55Upgrade libswresample2Upgrade libavfilter6Upgrade libavresample-develUpgrade ffmpegUpgrade libavdevice57Upgrade libavcodec57Upgrade libavformat57Upgrade libavresample3Upgrade libpostproc-develUpgrade libswscale-devel | Feb 4, 2022 | Jul 5, 2018 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub