The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cause a denial of service (integer signedness error and out-of-array read) via a crafted MPEG file.
CVSS Details
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Jan 30, 2018 | Nov 30, 2017 |
| Ffmpeg | — | Upgrade to FFmpeg version 3.2.9Upgrade to FFmpeg version 3.0.10Upgrade to FFmpeg version 3.4Upgrade to FFmpeg version 2.8.14Upgrade to FFmpeg version 3.3.6Upgrade to FFmpeg version 3.4.1Upgrade to FFmpeg version 3.2.10Upgrade to FFmpeg version 2.4.14Upgrade to FFmpeg version 3.3.5 | Dec 11, 2017 | Nov 30, 2017 |
| Freebsd | — | Upgrade ffmpeg | Jul 28, 2018 | Jul 27, 2018 |
| Suse | — | Upgrade libavformat-develUpgrade libswscale-develUpgrade libavfilter-develUpgrade libavdevice57Upgrade libavformat57Upgrade ffmpegUpgrade libavutil55Upgrade libswresample2Upgrade libavdevice-develUpgrade libavresample-develUpgrade libavcodec57Upgrade libavresample3Upgrade libpostproc-develUpgrade libavcodec-develUpgrade libswresample-develUpgrade libavutil-develUpgrade libavfilter6Upgrade libpostproc54Upgrade libswscale4 | Feb 20, 2018 | Nov 30, 2017 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Nov 30, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub