The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg4Upgrade ffmpeg | Aug 22, 2024 | Jul 23, 2018 |
| Debian | — | Upgrade ffmpeg | Feb 25, 2019 | Jul 23, 2018 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.0.2 | Sep 21, 2018 | Jul 23, 2018 |
| Suse | — | Upgrade libavresample3Upgrade libavfilter6Upgrade libavdevice57Upgrade libavcodec-develUpgrade libswscale-develUpgrade libswresample2Upgrade libavformat57Upgrade libswscale4Upgrade libavresample-develUpgrade ffmpegUpgrade libpostproc-develUpgrade libavformat-develUpgrade libavcodec57Upgrade libavutil-develUpgrade libpostproc54Upgrade libswresample-develUpgrade libavutil55 | Feb 4, 2022 | Jul 23, 2018 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Jul 23, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub