In FFmpeg 4.0.1, due to a missing check for negative values of the mquant variable, the vc1_put_blocks_clamped function in libavcodec/vc1_block.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to an information disclosure or a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 22, 2024 | Jul 5, 2018 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.0.2 | Jul 20, 2018 | Jul 5, 2018 |
| Suse | — | Upgrade libavcodec58-32bitUpgrade libpostproc54Upgrade libswresample2Upgrade ffmpegUpgrade libavutil56Upgrade libavformat58-32bitUpgrade libavformat-develUpgrade libavfilter7-64bitUpgrade ffmpeg-4-libavutil-develUpgrade libswscale-develUpgrade ffmpeg-4-libavfilter-develUpgrade libavfilter7-32bitUpgrade libavresample4Upgrade libavutil55Upgrade libavdevice57Upgrade libswresample3-32bitUpgrade libavcodec-develUpgrade libavdevice58Upgrade libswscale4Upgrade libavcodec58Upgrade ffmpeg-4-libswresample-develUpgrade ffmpeg-4-libavresample-develUpgrade libavresample-develUpgrade libavutil56-64bitUpgrade libavdevice58-32bitUpgrade libswresample3-64bitUpgrade libavutil56-32bitUpgrade ffmpeg-4-libswscale-develUpgrade ffmpeg-4-private-develUpgrade libavresample4-32bitUpgrade libswresample-develUpgrade libavfilter7Upgrade libswscale5-64bitUpgrade libavfilter6Upgrade libpostproc55-64bitUpgrade libswscale5Upgrade libavdevice58-64bitUpgrade libavresample3Upgrade libavcodec57Upgrade ffmpeg-4-libavformat-develUpgrade libpostproc55-32bitUpgrade ffmpeg-4-libpostproc-develUpgrade libavformat57Upgrade libswscale5-32bitUpgrade libpostproc55Upgrade libswresample3Upgrade libavutil-develUpgrade libpostproc-develUpgrade libavresample4-64bitUpgrade libavcodec58-64bitUpgrade libavformat58-64bitUpgrade libavformat58Upgrade ffmpeg-4-libavcodec-develUpgrade ffmpeg-4-libavdevice-devel | Jan 15, 2020 | Jul 5, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub