A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handle_open_brace in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg4Upgrade ffmpeg | Aug 22, 2024 | Mar 12, 2019 |
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Mar 12, 2019 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.1.2 | Mar 14, 2019 | Mar 12, 2019 |
| Suse | — | Upgrade libpostproc54Upgrade libavutil55Upgrade libavdevice57-32bitUpgrade libpostproc-develUpgrade libavresample3-64bitUpgrade libavcodec57-32bitUpgrade libswresample2-32bitUpgrade libswscale-develUpgrade libswscale4Upgrade libavformat57-32bitUpgrade libswresample-develUpgrade ffmpeg-private-develUpgrade libavfilter6Upgrade libavfilter6-32bitUpgrade libpostproc54-32bitUpgrade libswscale4-32bitUpgrade libavresample-develUpgrade libavutil-develUpgrade libavformat-develUpgrade libavfilter-develUpgrade libavutil55-32bitUpgrade ffmpegUpgrade libswresample2Upgrade libavcodec-develUpgrade libavcodec57Upgrade libavdevice-develUpgrade libavdevice57Upgrade libavresample3-32bitUpgrade libavformat57Upgrade libavresample3 | Sep 3, 2021 | Mar 12, 2019 |
| Ubuntu | — | Upgrade libpostproc55Upgrade libavcodec-extra58Upgrade libavformat58Upgrade libswscale5Upgrade libpostproc54Upgrade libavcodec-extra57Upgrade libavfilter6Upgrade libswresample3Upgrade libavcodec58Upgrade libavfilter-extra7Upgrade ffmpegUpgrade libswresample2Upgrade libavdevice57Upgrade libswscale4Upgrade libavdevice58Upgrade libavfilter7Upgrade libavutil56Upgrade libavresample3Upgrade libavutil55Upgrade libavresample4Upgrade libavfilter-extra6Upgrade libavformat57Upgrade libavcodec57 | May 7, 2019 | Mar 12, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub