In FFmpeg 4.0.1, due to a missing check of a profile value before setting it, the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg4Upgrade ffmpeg | Aug 30, 2018 | Jul 5, 2018 |
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Jul 5, 2018 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.1Upgrade to FFmpeg version 4.0.2 | Jul 19, 2018 | Jul 5, 2018 |
| Suse | — | Upgrade libswscale-develUpgrade libpostproc-develUpgrade libavcodec57Upgrade ffmpegUpgrade libavresample3Upgrade libavdevice57Upgrade libavformat57Upgrade libavutil-develUpgrade libavcodec-develUpgrade libswscale4Upgrade libavutil55Upgrade libpostproc54Upgrade libswresample-develUpgrade libswresample2Upgrade libavformat-develUpgrade libavresample-develUpgrade libavfilter6 | Feb 4, 2022 | Jul 5, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub