The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 22, 2024 | Jul 23, 2018 |
| Debian | — | Upgrade ffmpeg | Feb 25, 2019 | Jul 23, 2018 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.0.2 | Sep 21, 2018 | Jul 23, 2018 |
| Suse | — | Upgrade libswscale-develUpgrade libpostproc-develUpgrade ffmpegUpgrade libavcodec-develUpgrade libavresample3Upgrade libswresample2Upgrade libavresample-develUpgrade libswscale4Upgrade libavformat-develUpgrade libavformat57Upgrade libavdevice57Upgrade libavfilter6Upgrade libavutil55Upgrade libavutil-develUpgrade libswresample-develUpgrade libavcodec57Upgrade libpostproc54 | Feb 4, 2022 | Jul 23, 2018 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Jul 23, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub