libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg4Upgrade ffmpeg | Aug 22, 2024 | Apr 18, 2019 |
| Debian | — | Upgrade ffmpeg | May 23, 2019 | Apr 19, 2019 |
| Ffmpeg | — | Upgrade to FFmpeg version 3.2.14Upgrade to FFmpeg version 4.2Upgrade to FFmpeg version 4.1.3Upgrade to FFmpeg version 3.4.6Upgrade to FFmpeg version 2.8.16 | Apr 22, 2019 | Apr 19, 2019 |
| Suse | — | Upgrade libavformat58Upgrade libavcodec58-64bitUpgrade libpostproc55-64bitUpgrade libavutil56-64bitUpgrade libavutil56Upgrade libswscale5-32bitUpgrade libswresample3-64bitUpgrade libavformat58-64bitUpgrade ffmpeg-4-libpostproc-develUpgrade libavdevice58-32bitUpgrade libavresample4-32bitUpgrade libpostproc55Upgrade ffmpeg-4-libavutil-develUpgrade libswscale5Upgrade libavutil56-32bitUpgrade ffmpeg-4-libavdevice-develUpgrade libavfilter7Upgrade libavdevice58-64bitUpgrade libavresample4-64bitUpgrade libswscale5-64bitUpgrade libavfilter7-32bitUpgrade ffmpeg-4-libavcodec-develUpgrade libavresample4Upgrade ffmpeg-4-libavformat-develUpgrade libavcodec58-32bitUpgrade ffmpeg-4-private-develUpgrade libavdevice58Upgrade ffmpeg-4-libswresample-develUpgrade libavformat58-32bitUpgrade ffmpeg-4-libavfilter-develUpgrade libswresample3-32bitUpgrade ffmpeg-4-libswscale-develUpgrade libpostproc55-32bitUpgrade ffmpeg-4-libavresample-develUpgrade libswresample3Upgrade libavfilter7-64bitUpgrade libavcodec58 | Jan 15, 2020 | Apr 18, 2019 |
| Ubuntu | — | Upgrade libavcodec-ffmpeg-extra56Upgrade libswresample3Upgrade libavfilter-extra6Upgrade libswscale-ffmpeg3Upgrade libavresample-ffmpeg2Upgrade libavresample4Upgrade libavformat58Upgrade libavdevice-ffmpeg56Upgrade libavutil55Upgrade libpostproc54Upgrade libavcodec-extra58Upgrade libavfilter7Upgrade libavcodec57Upgrade libswresample-ffmpeg1Upgrade libavdevice57Upgrade libpostproc-ffmpeg53Upgrade libavdevice58Upgrade libavcodec58Upgrade libswresample2Upgrade libswscale4Upgrade libswscale5Upgrade libavfilter6Upgrade libavutil56Upgrade libpostproc55Upgrade libavutil-ffmpeg54Upgrade libavfilter-ffmpeg5Upgrade ffmpegUpgrade libavformat-ffmpeg56Upgrade libavformat57Upgrade libavfilter-extra7Upgrade libavcodec-ffmpeg56Upgrade libavresample3Upgrade libavcodec-extra57 | May 7, 2019 | Apr 18, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub