cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 22, 2024 | Apr 28, 2020 |
| Debian | — | Upgrade ffmpeg | Jul 10, 2020 | Apr 28, 2020 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.3Upgrade to FFmpeg version 4.2.3Upgrade to FFmpeg version 4.1.6 | May 6, 2020 | Apr 28, 2020 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Jul 29, 2020 | Apr 28, 2020 |
| Ubuntu | — | Upgrade libavdevice57Upgrade libavresample3Upgrade libavfilter-extra7Upgrade libpostproc55Upgrade libavcodec-ffmpeg56Upgrade libavfilter-ffmpeg5Upgrade libavcodec57Upgrade libavcodec58Upgrade libswscale5Upgrade libavfilter6Upgrade libavcodec-extra57Upgrade libswresample3Upgrade libavdevice58Upgrade libavformat57Upgrade libavutil56Upgrade libswresample2Upgrade ffmpegUpgrade libswresample-ffmpeg1Upgrade libavfilter7Upgrade libavformat58Upgrade libavcodec-ffmpeg-extra56Upgrade libavcodec-extra58Upgrade libswscale-ffmpeg3Upgrade libpostproc-ffmpeg53Upgrade libpostproc54Upgrade libavresample4Upgrade libavfilter-extra6Upgrade libavformat-ffmpeg56Upgrade libavdevice-ffmpeg56Upgrade libavresample-ffmpeg2Upgrade libavutil55Upgrade libavutil-ffmpeg54Upgrade libswscale4 | Aug 5, 2020 | Apr 28, 2020 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub