In FFmpeg 4.0.1, due to a missing check of a profile value before setting it, the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 30, 2018 | Jul 5, 2018 |
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Jul 5, 2018 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.0.2Upgrade to FFmpeg version 4.1 | Jul 19, 2018 | Jul 5, 2018 |
| Suse | — | Upgrade libavcodec-develUpgrade libswresample2Upgrade libavutil-develUpgrade libpostproc54Upgrade libswresample-develUpgrade libavutil55Upgrade libavresample-develUpgrade libavfilter6Upgrade libavformat-develUpgrade libswscale4Upgrade libpostproc-develUpgrade libswscale-develUpgrade libavformat57Upgrade libavcodec57Upgrade libavdevice57Upgrade libavresample3Upgrade ffmpeg | Feb 4, 2022 | Jul 5, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub