The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (Infinite Loop) via a crafted XML file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 30, 2018 | Apr 24, 2018 |
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Apr 24, 2018 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.0Upgrade to FFmpeg version 3.4.3 | Apr 24, 2018 | Apr 24, 2018 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Mar 31, 2020 | Apr 24, 2018 |
| Suse | — | Upgrade libswresample3Upgrade libavutil56Upgrade libavfilter7Upgrade libavcodec58Upgrade libpostproc55_9Upgrade libavdevice58Upgrade libavresample4Upgrade libavutil56_70Upgrade libavresample4_0Upgrade libavfilter7_110Upgrade libswscale5_9Upgrade libavcodec58_134Upgrade libavformat58Upgrade libswresample3_9Upgrade libavdevice58_13Upgrade libpostproc55Upgrade libavformat58_76Upgrade libswscale5 | Aug 9, 2024 | Apr 24, 2018 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Apr 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub