aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 22, 2024 | Jun 4, 2019 |
| Debian | — | Upgrade ffmpeg | Jun 6, 2019 | Jun 4, 2019 |
| Ffmpeg | — | Upgrade to FFmpeg version 3.2.14 | Jun 6, 2019 | Jun 4, 2019 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Mar 31, 2020 | Jun 4, 2019 |
| Suse | — | Upgrade ffmpegUpgrade libswresample-develUpgrade libpostproc54Upgrade libavutil55Upgrade libswscale-develUpgrade libavcodec57Upgrade libavresample3Upgrade libavdevice57Upgrade libswresample2Upgrade libavformat-develUpgrade libavresample-develUpgrade libswscale4Upgrade libavfilter6Upgrade libavcodec-develUpgrade libpostproc-develUpgrade libavformat57Upgrade libavutil-devel | Feb 4, 2022 | Jun 4, 2019 |
| Ubuntu | — | Upgrade libavdevice57Upgrade libavresample3Upgrade libavutil55Upgrade libswresample3Upgrade libavresample4Upgrade libavcodec-ffmpeg56Upgrade libavcodec-ffmpeg-extra56Upgrade libavfilter-ffmpeg5Upgrade libavresample-ffmpeg2Upgrade libavformat-ffmpeg56Upgrade libswscale5Upgrade libavformat57Upgrade libavfilter-extra6Upgrade libavformat58Upgrade libavcodec-extra58Upgrade libavutil-ffmpeg54Upgrade libswresample-ffmpeg1Upgrade libavfilter6Upgrade libavcodec57Upgrade libswscale4Upgrade libpostproc55Upgrade libpostproc54Upgrade libpostproc-ffmpeg53Upgrade libavfilter-extra7Upgrade libavdevice58Upgrade libavcodec58Upgrade libavfilter7Upgrade libswresample2Upgrade libavdevice-ffmpeg56Upgrade libavutil56Upgrade ffmpegUpgrade libswscale-ffmpeg3Upgrade libavcodec-extra57 | Aug 5, 2020 | Jun 4, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub