The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (Infinite Loop) via a crafted XML file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg4Upgrade ffmpeg | Aug 30, 2018 | Apr 24, 2018 |
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Apr 24, 2018 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.0Upgrade to FFmpeg version 3.4.3 | Apr 24, 2018 | Apr 24, 2018 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Mar 31, 2020 | Apr 24, 2018 |
| Suse | — | Upgrade libavresample4Upgrade libavformat58Upgrade libavfilter7Upgrade libavutil56_70Upgrade libavresample4_0Upgrade libavcodec58_134Upgrade libavcodec58Upgrade libavfilter7_110Upgrade libavutil56Upgrade libswscale5_9Upgrade libswresample3Upgrade libavdevice58Upgrade libpostproc55_9Upgrade libswresample3_9Upgrade libavdevice58_13Upgrade libpostproc55Upgrade libavformat58_76Upgrade libswscale5 | Aug 9, 2024 | Apr 24, 2018 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Apr 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub