In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg4Upgrade ffmpeg | Aug 22, 2024 | Mar 12, 2019 |
| Debian | — | Upgrade ffmpeg | May 23, 2019 | Mar 12, 2019 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.1.2 | Mar 14, 2019 | Mar 12, 2019 |
| Suse | — | Upgrade libavcodec-develUpgrade libpostproc-develUpgrade libavfilter6Upgrade libswresample-develUpgrade libpostproc54Upgrade libavutil-develUpgrade libavdevice57Upgrade ffmpegUpgrade libavformat57Upgrade libavformat-develUpgrade libavresample3Upgrade libavresample-develUpgrade libavutil55Upgrade libswscale-develUpgrade libswresample2Upgrade libswscale4Upgrade libavcodec57 | Feb 4, 2022 | Mar 12, 2019 |
| Ubuntu | — | Upgrade libavfilter7Upgrade libavformat58Upgrade libavutil55Upgrade libavresample4Upgrade libavdevice57Upgrade libavfilter-extra6Upgrade libavcodec57Upgrade libavcodec-extra58Upgrade libpostproc54Upgrade libswresample3Upgrade libavutil56Upgrade libavresample3Upgrade libavfilter-extra7Upgrade libswscale5Upgrade libavfilter6Upgrade ffmpegUpgrade libavcodec-extra57Upgrade libswscale4Upgrade libswresample2Upgrade libpostproc55Upgrade libavformat57Upgrade libavdevice58Upgrade libavcodec58 | May 7, 2019 | Mar 12, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub