The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (Infinite Loop) via a crafted XML file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 30, 2018 | Apr 24, 2018 |
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Apr 24, 2018 |
| Ffmpeg | — | Upgrade to FFmpeg version 3.4.3Upgrade to FFmpeg version 4.0 | Apr 24, 2018 | Apr 24, 2018 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Mar 31, 2020 | Apr 24, 2018 |
| Suse | — | Upgrade libavformat58_76Upgrade libswscale5Upgrade libavdevice58_13Upgrade libpostproc55Upgrade libswresample3_9Upgrade libswscale5_9Upgrade libavresample4Upgrade libavfilter7Upgrade libavformat58Upgrade libavcodec58Upgrade libavresample4_0Upgrade libpostproc55_9Upgrade libavutil56_70Upgrade libavfilter7_110Upgrade libswresample3Upgrade libavutil56Upgrade libavcodec58_134Upgrade libavdevice58 | Aug 9, 2024 | Apr 24, 2018 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Apr 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub