FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in av_probe_input_format3 in libavformat/format.c.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 22, 2024 | Jun 7, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 7, 2020 |
| Debian | — | Upgrade ffmpeg | Jul 10, 2020 | Jun 7, 2020 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.4Upgrade to FFmpeg version 4.2.4Upgrade to FFmpeg version 4.3.1Upgrade to FFmpeg version 3.4.8Upgrade to FFmpeg version 2.8.17Upgrade to FFmpeg version 3.2.15Upgrade to FFmpeg version 4.1.6Upgrade to FFmpeg version 4.0.6 | Jun 15, 2020 | Jun 7, 2020 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Jul 29, 2020 | Jun 7, 2020 |
| Suse | — | Upgrade ffmpeg-private-develUpgrade libswscale4-32bitUpgrade libavfilter6Upgrade libavformat57-32bitUpgrade libavutil55Upgrade libavfilter6-32bitUpgrade libavcodec57Upgrade libpostproc54-32bitUpgrade libswresample-develUpgrade ffmpegUpgrade libswscale-develUpgrade libavutil-develUpgrade libswresample2-32bitUpgrade libavcodec57-32bitUpgrade libavdevice57-32bitUpgrade libpostproc54Upgrade libavresample3-32bitUpgrade libavfilter-develUpgrade libavutil55-32bitUpgrade libavformat57Upgrade libavcodec-develUpgrade libswscale4Upgrade libavdevice-develUpgrade libswresample2Upgrade libavresample3Upgrade libavdevice57Upgrade libpostproc-develUpgrade libavresample-develUpgrade libavformat-devel | Jul 15, 2021 | Jun 7, 2020 |
| Ubuntu | — | Upgrade libswresample3Upgrade libavdevice58Upgrade libavfilter-ffmpeg5Upgrade libavfilter-extra6Upgrade libavformat57Upgrade libavcodec58Upgrade libavfilter-extra7Upgrade libavresample3Upgrade libavcodec-ffmpeg-extra56Upgrade ffmpegUpgrade libpostproc-ffmpeg53Upgrade libpostproc55Upgrade libavfilter6Upgrade libavcodec-extra57Upgrade libswresample-ffmpeg1Upgrade libavdevice57Upgrade libavresample-ffmpeg2Upgrade libswresample2Upgrade libavcodec-extra58Upgrade libavdevice-ffmpeg56Upgrade libavcodec-ffmpeg56Upgrade libavformat-ffmpeg56Upgrade libswscale-ffmpeg3Upgrade libavresample4Upgrade libavcodec57Upgrade libpostproc54Upgrade libswscale4Upgrade libswscale5Upgrade libavutil55Upgrade libavformat58Upgrade libavutil-ffmpeg54Upgrade libavfilter7Upgrade libavutil56 | Aug 5, 2020 | Jun 7, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub