aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 22, 2024 | Jun 4, 2019 |
| Debian | — | Upgrade ffmpeg | Jun 6, 2019 | Jun 4, 2019 |
| Ffmpeg | — | Upgrade to FFmpeg version 3.2.14 | Jun 6, 2019 | Jun 4, 2019 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Mar 31, 2020 | Jun 4, 2019 |
| Suse | — | Upgrade libavcodec-develUpgrade libavformat-develUpgrade libavfilter6Upgrade libswresample2Upgrade libavresample3Upgrade libavdevice57Upgrade libswscale4Upgrade libavformat57Upgrade libpostproc-develUpgrade libavresample-develUpgrade libavutil-develUpgrade libswscale-develUpgrade libavcodec57Upgrade libavutil55Upgrade ffmpegUpgrade libswresample-develUpgrade libpostproc54 | Feb 4, 2022 | Jun 4, 2019 |
| Ubuntu | — | Upgrade libavdevice-ffmpeg56Upgrade libpostproc54Upgrade libswscale-ffmpeg3Upgrade libavcodec57Upgrade libswresample2Upgrade libavutil-ffmpeg54Upgrade libavcodec58Upgrade libavfilter6Upgrade libavcodec-extra57Upgrade libavcodec-extra58Upgrade libswscale4Upgrade ffmpegUpgrade libavutil56Upgrade libavdevice58Upgrade libavfilter7Upgrade libavfilter-extra7Upgrade libpostproc-ffmpeg53Upgrade libpostproc55Upgrade libswresample-ffmpeg1Upgrade libavresample4Upgrade libavformat58Upgrade libavcodec-ffmpeg-extra56Upgrade libavresample-ffmpeg2Upgrade libavformat57Upgrade libavutil55Upgrade libavformat-ffmpeg56Upgrade libavcodec-ffmpeg56Upgrade libavfilter-ffmpeg5Upgrade libavfilter-extra6Upgrade libavdevice57Upgrade libavresample3Upgrade libswresample3Upgrade libswscale5 | Aug 5, 2020 | Jun 4, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub