The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (Infinite Loop) via a crafted XML file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 30, 2018 | Apr 24, 2018 |
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Apr 24, 2018 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.0Upgrade to FFmpeg version 3.4.3 | Apr 24, 2018 | Apr 24, 2018 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Mar 31, 2020 | Apr 24, 2018 |
| Suse | — | Upgrade libswscale5Upgrade libavformat58_76Upgrade libpostproc55Upgrade libswresample3_9Upgrade libavdevice58_13Upgrade libavutil56Upgrade libavcodec58Upgrade libpostproc55_9Upgrade libavresample4_0Upgrade libavfilter7Upgrade libavdevice58Upgrade libswresample3Upgrade libavcodec58_134Upgrade libavfilter7_110Upgrade libavformat58Upgrade libavresample4Upgrade libavutil56_70Upgrade libswscale5_9 | Aug 9, 2024 | Apr 24, 2018 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Apr 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub