In FFmpeg 4.0.1, improper handling of frame types (other than EAC3_FRAME_TYPE_INDEPENDENT) that have multiple independent substreams in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to a denial of service or possibly unspecified other impact.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg4Upgrade ffmpeg | Aug 30, 2018 | Jul 5, 2018 |
| Debian | — | Upgrade ffmpeg | Jul 19, 2018 | Jul 5, 2018 |
| Ffmpeg | — | Upgrade to FFmpeg version 3.0.12Upgrade to FFmpeg version 4.0.2Upgrade to FFmpeg version 3.4.3Upgrade to FFmpeg version 4.1Upgrade to FFmpeg version 3.3.8Upgrade to FFmpeg version 3.2.11Upgrade to FFmpeg version 2.8.15 | Jul 19, 2018 | Jul 5, 2018 |
| Suse | — | Upgrade libavdevice57Upgrade libavutil-develUpgrade libavcodec-develUpgrade libpostproc54Upgrade libavutil55Upgrade libavcodec57Upgrade libavfilter6Upgrade libavformat-develUpgrade libavresample-develUpgrade libswscale4Upgrade ffmpegUpgrade libavresample3Upgrade libpostproc-develUpgrade libswresample2Upgrade libavformat57Upgrade libswscale-develUpgrade libswresample-devel | Feb 4, 2022 | Jul 5, 2018 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Jul 5, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub