In FFmpeg 4.0.1, due to a missing check for negative values of the mquant variable, the vc1_put_blocks_clamped function in libavcodec/vc1_block.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to an information disclosure or a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg4Upgrade ffmpeg | Aug 22, 2024 | Jul 5, 2018 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.0.2 | Jul 20, 2018 | Jul 5, 2018 |
| Suse | — | Upgrade ffmpeg-4-libavutil-develUpgrade libavformat-develUpgrade libpostproc54Upgrade libavcodec58-32bitUpgrade ffmpeg-4-libswresample-develUpgrade libavutil56Upgrade libswresample3-32bitUpgrade libswscale4Upgrade libavdevice57Upgrade ffmpegUpgrade libavcodec-develUpgrade libavdevice58Upgrade libavformat58-32bitUpgrade libavfilter7-32bitUpgrade libavutil55Upgrade ffmpeg-4-libavresample-develUpgrade libavresample4Upgrade libswresample2Upgrade libswscale-develUpgrade libavfilter7-64bitUpgrade libavcodec58Upgrade libavresample-develUpgrade ffmpeg-4-libavfilter-develUpgrade ffmpeg-4-libavdevice-develUpgrade libavutil56-32bitUpgrade ffmpeg-4-libavformat-develUpgrade libpostproc-develUpgrade libswscale5-64bitUpgrade libavdevice58-64bitUpgrade libavutil-develUpgrade libpostproc55-32bitUpgrade libavresample3Upgrade libswscale5Upgrade libavcodec57Upgrade libavdevice58-32bitUpgrade libpostproc55Upgrade libavformat58Upgrade libavformat58-64bitUpgrade libswresample3Upgrade libavcodec58-64bitUpgrade libavresample4-64bitUpgrade ffmpeg-4-libavcodec-develUpgrade libavfilter7Upgrade libpostproc55-64bitUpgrade ffmpeg-4-libswscale-develUpgrade libavfilter6Upgrade ffmpeg-4-private-develUpgrade ffmpeg-4-libpostproc-develUpgrade libswresample-develUpgrade libavresample4-32bitUpgrade libswresample3-64bitUpgrade libavutil56-64bitUpgrade libavformat57Upgrade libswscale5-32bit | Jan 15, 2020 | Jul 5, 2018 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub