FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg4Upgrade ffmpeg | Aug 22, 2024 | Jul 23, 2018 |
| Debian | — | Upgrade ffmpeg | Feb 25, 2019 | Jul 23, 2018 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.0.2 | Sep 21, 2018 | Jul 23, 2018 |
| Suse | — | Upgrade libswscale-develUpgrade libavdevice57Upgrade libavformat-develUpgrade libswscale4Upgrade libavfilter6Upgrade libavresample3Upgrade libpostproc-develUpgrade libavcodec-develUpgrade libavresample-develUpgrade libavformat57Upgrade libswresample2Upgrade ffmpegUpgrade libavutil55Upgrade libpostproc54Upgrade libavcodec57Upgrade libavutil-develUpgrade libswresample-devel | Feb 4, 2022 | Jul 23, 2018 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Jul 23, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub