In FFmpeg 4.0.1, due to a missing check for negative values of the mquant variable, the vc1_put_blocks_clamped function in libavcodec/vc1_block.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to an information disclosure or a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 22, 2024 | Jul 5, 2018 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.0.2 | Jul 20, 2018 | Jul 5, 2018 |
| Suse | — | Upgrade libavformat58Upgrade libavcodec58-64bitUpgrade libavformat58-64bitUpgrade ffmpeg-4-libswscale-develUpgrade libswresample3Upgrade libswscale5Upgrade libavfilter6Upgrade libswscale5-32bitUpgrade libpostproc55Upgrade libavfilter7Upgrade libpostproc55-64bitUpgrade libavdevice58-32bitUpgrade libavformat57Upgrade ffmpeg-4-libpostproc-develUpgrade libavresample4-64bitUpgrade ffmpeg-4-libavcodec-develUpgrade ffmpeg-4-private-develUpgrade libpostproc55-32bitUpgrade ffmpeg-4-libavdevice-develUpgrade libpostproc-develUpgrade libavutil56-64bitUpgrade libavcodec57Upgrade libswresample3-64bitUpgrade libswscale5-64bitUpgrade libavresample4-32bitUpgrade ffmpeg-4-libavformat-develUpgrade libavdevice58-64bitUpgrade libswresample-develUpgrade libavutil56-32bitUpgrade libavresample3Upgrade libavutil-develUpgrade ffmpeg-4-libavutil-develUpgrade ffmpegUpgrade libavfilter7-32bitUpgrade libavdevice58Upgrade libswscale4Upgrade libavformat-develUpgrade libpostproc54Upgrade libavcodec-develUpgrade libavfilter7-64bitUpgrade libavformat58-32bitUpgrade ffmpeg-4-libavfilter-develUpgrade ffmpeg-4-libswresample-develUpgrade libavresample-develUpgrade ffmpeg-4-libavresample-develUpgrade libavutil55Upgrade libavutil56Upgrade libswresample3-32bitUpgrade libswresample2Upgrade libavcodec58Upgrade libswscale-develUpgrade libavdevice57Upgrade libavcodec58-32bitUpgrade libavresample4 | Jan 15, 2020 | Jul 5, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub