The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cause a denial of service (integer signedness error and out-of-array read) via a crafted MPEG file.
CVSS Details
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Jan 30, 2018 | Nov 30, 2017 |
| Ffmpeg | — | Upgrade to FFmpeg version 3.4Upgrade to FFmpeg version 3.2.9Upgrade to FFmpeg version 3.0.10Upgrade to FFmpeg version 3.3.6Upgrade to FFmpeg version 3.3.5Upgrade to FFmpeg version 3.4.1Upgrade to FFmpeg version 2.8.14Upgrade to FFmpeg version 3.2.10Upgrade to FFmpeg version 2.4.14 | Dec 11, 2017 | Nov 30, 2017 |
| Freebsd | — | Upgrade ffmpeg | Jul 28, 2018 | Jul 27, 2018 |
| Suse | — | Upgrade ffmpegUpgrade libavdevice-develUpgrade libswresample2Upgrade libavformat57Upgrade libavresample3Upgrade libswscale-develUpgrade libavcodec57Upgrade libavresample-develUpgrade libavutil55Upgrade libavformat-develUpgrade libavdevice57Upgrade libavfilter-develUpgrade libavutil-develUpgrade libpostproc-develUpgrade libswresample-develUpgrade libpostproc54Upgrade libavcodec-develUpgrade libavfilter6Upgrade libswscale4 | Feb 20, 2018 | Nov 30, 2017 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Nov 30, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub