The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read.
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Dec 5, 2017 | Nov 6, 2017 |
| Ffmpeg | — | Upgrade to FFmpeg version 3.3.5 | Nov 29, 2017 | Nov 6, 2017 |
| Freebsd | — | Upgrade ffmpeg | Jul 28, 2018 | Jul 27, 2018 |
| Suse | — | Upgrade libavutil-develUpgrade libpostproc-develUpgrade libpostproc54Upgrade libavfilter6Upgrade libavcodec57Upgrade libavresample3Upgrade libavutil55Upgrade ffmpegUpgrade libswscale-develUpgrade libavresample-develUpgrade libswresample-develUpgrade libswresample2Upgrade libavcodec-develUpgrade libswscale4Upgrade libavformat57Upgrade libavfilter-develUpgrade libavdevice-develUpgrade libavdevice57Upgrade libavformat-devel | Feb 20, 2018 | Nov 6, 2017 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Nov 6, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub