In FFmpeg 3.2 and 4.0.1, an improper argument (AVCodecParameters) passed to the avpriv_request_sample function in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array read while converting a crafted AVI file to MPEG4, leading to a denial of service and possibly an information disclosure.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg4Upgrade ffmpeg | Aug 30, 2018 | Jul 5, 2018 |
| Debian | — | Upgrade ffmpeg | Jul 19, 2018 | Jul 5, 2018 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.0.2Upgrade to FFmpeg version 3.2.11Upgrade to FFmpeg version 4.1Upgrade to FFmpeg version 3.3.8Upgrade to FFmpeg version 3.4.3 | Jul 19, 2018 | Jul 5, 2018 |
| Suse | — | Upgrade ffmpeg-4-libpostproc-develUpgrade libavutil-develUpgrade libavcodec57Upgrade libswresample2Upgrade libavdevice58Upgrade libavformat58-64bitUpgrade ffmpeg-4-libavresample-develUpgrade libswscale5Upgrade ffmpeg-4-libavutil-develUpgrade libavcodec58-64bitUpgrade libavfilter6Upgrade libavutil56Upgrade libpostproc-develUpgrade libswscale4Upgrade ffmpeg-4-libswresample-develUpgrade libavdevice58-64bitUpgrade libavformat-develUpgrade libavresample-develUpgrade libavfilter7Upgrade libavcodec58Upgrade ffmpeg-4-private-develUpgrade ffmpeg-4-libavformat-develUpgrade libavutil56-64bitUpgrade libavresample4-64bitUpgrade ffmpeg-4-libavdevice-develUpgrade libswresample-develUpgrade libswscale-develUpgrade libpostproc54Upgrade libpostproc55Upgrade libavresample4Upgrade libavresample3Upgrade libavformat58Upgrade libavcodec-develUpgrade libavdevice57Upgrade libswresample3-64bitUpgrade libpostproc55-64bitUpgrade ffmpeg-4-libswscale-develUpgrade libavformat57Upgrade libavutil55Upgrade libavfilter7-64bitUpgrade libswresample3Upgrade ffmpeg-4-libavcodec-develUpgrade ffmpeg-4-libavfilter-develUpgrade ffmpegUpgrade libswscale5-64bit | Sep 17, 2018 | Jul 5, 2018 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Jul 5, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub