The VC-2 Video Compression encoder in FFmpeg 3.0 and 3.4 allows remote attackers to cause a denial of service (out-of-bounds read) because of incorrect buffer padding for non-Haar wavelets, related to libavcodec/vc2enc.c and libavcodec/vc2enc_dwt.c.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Dec 5, 2017 | Nov 21, 2017 |
| Ffmpeg | — | Upgrade to FFmpeg version 3.0.10Upgrade to FFmpeg version 3.3.6Upgrade to FFmpeg version 3.4.1Upgrade to FFmpeg version 3.2.10 | Dec 11, 2017 | Nov 21, 2017 |
| Freebsd | — | Upgrade ffmpeg | Jul 28, 2018 | Jul 27, 2018 |
| Suse | — | Upgrade libavformat57Upgrade libpostproc-develUpgrade libavresample3Upgrade libswscale-develUpgrade libavdevice-develUpgrade libavfilter6Upgrade libavdevice57Upgrade libavcodec57Upgrade ffmpegUpgrade libpostproc54Upgrade libavutil55Upgrade libavcodec-develUpgrade libavutil-develUpgrade libswresample-develUpgrade libavformat-develUpgrade libswresample2Upgrade libswscale4Upgrade libavresample-develUpgrade libavfilter-devel | Feb 20, 2018 | Nov 21, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub