FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asf_o format demuxer that can result in heap-buffer-overflow that may result in remote code execution. This attack appears to be exploitable via specially crafted ASF file that has to be provided as input to FFmpeg. This vulnerability appears to have been fixed in 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 and later.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 22, 2024 | Jul 23, 2018 |
| Debian | — | Upgrade ffmpeg | May 23, 2019 | Jul 23, 2018 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.0.2 | Sep 21, 2018 | Jul 23, 2018 |
| Suse | — | Upgrade libswscale4Upgrade libpostproc54Upgrade libavfilter6Upgrade libavcodec-develUpgrade libpostproc-develUpgrade libswresample-develUpgrade libavutil-develUpgrade libswscale-develUpgrade libavdevice57Upgrade libavresample-develUpgrade libavresample3Upgrade libswresample2Upgrade libavcodec57Upgrade libavformat57Upgrade libavformat-develUpgrade libavutil55Upgrade ffmpeg | Feb 4, 2022 | Jul 23, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub