cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg4Upgrade ffmpeg | Aug 22, 2024 | Apr 28, 2020 |
| Debian | — | Upgrade ffmpeg | Jul 10, 2020 | Apr 28, 2020 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.3Upgrade to FFmpeg version 4.1.6Upgrade to FFmpeg version 4.2.3 | May 6, 2020 | Apr 28, 2020 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Jul 29, 2020 | Apr 28, 2020 |
| Ubuntu | — | Upgrade libavcodec57Upgrade libpostproc55Upgrade libavdevice58Upgrade libswresample2Upgrade libavfilter-ffmpeg5Upgrade libavfilter-extra7Upgrade libavcodec58Upgrade libavformat57Upgrade libavcodec-ffmpeg56Upgrade libswresample3Upgrade libswscale5Upgrade libavdevice57Upgrade libavresample3Upgrade libavfilter6Upgrade libavcodec-extra57Upgrade libavutil56Upgrade libavfilter-extra6Upgrade libavcodec-ffmpeg-extra56Upgrade libpostproc54Upgrade libswscale-ffmpeg3Upgrade libswscale4Upgrade libavresample-ffmpeg2Upgrade libavutil55Upgrade libavformat58Upgrade libavcodec-extra58Upgrade libavfilter7Upgrade libavresample4Upgrade libswresample-ffmpeg1Upgrade libavutil-ffmpeg54Upgrade libpostproc-ffmpeg53Upgrade libavdevice-ffmpeg56Upgrade ffmpegUpgrade libavformat-ffmpeg56 | Aug 5, 2020 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub