FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asf_o format demuxer that can result in heap-buffer-overflow that may result in remote code execution. This attack appears to be exploitable via specially crafted ASF file that has to be provided as input to FFmpeg. This vulnerability appears to have been fixed in 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 and later.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 22, 2024 | Jul 23, 2018 |
| Debian | — | Upgrade ffmpeg | May 23, 2019 | Jul 23, 2018 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.0.2 | Sep 21, 2018 | Jul 23, 2018 |
| Suse | — | Upgrade libswresample-develUpgrade libswscale4Upgrade libavutil-develUpgrade libpostproc-develUpgrade libpostproc54Upgrade libavcodec-develUpgrade libavfilter6Upgrade libswresample2Upgrade libswscale-develUpgrade libavcodec57Upgrade ffmpegUpgrade libavresample3Upgrade libavformat57Upgrade libavformat-develUpgrade libavutil55Upgrade libavdevice57Upgrade libavresample-devel | Feb 4, 2022 | Jul 23, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub