aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 22, 2024 | Jun 4, 2019 |
| Debian | — | Upgrade ffmpeg | Jun 6, 2019 | Jun 4, 2019 |
| Ffmpeg | — | Upgrade to FFmpeg version 3.2.14 | Jun 6, 2019 | Jun 4, 2019 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Mar 31, 2020 | Jun 4, 2019 |
| Suse | — | Upgrade libavformat-develUpgrade libswscale4Upgrade libavutil-develUpgrade libavfilter6Upgrade libavresample-develUpgrade libavresample3Upgrade libavformat57Upgrade libavcodec-develUpgrade libavdevice57Upgrade libswresample2Upgrade libpostproc-develUpgrade libswscale-develUpgrade libavutil55Upgrade libswresample-develUpgrade ffmpegUpgrade libpostproc54Upgrade libavcodec57 | Feb 4, 2022 | Jun 4, 2019 |
| Ubuntu | — | Upgrade libswresample2Upgrade libpostproc55Upgrade libavfilter6Upgrade libavdevice58Upgrade libavutil56Upgrade libavcodec58Upgrade libavfilter7Upgrade libswscale-ffmpeg3Upgrade libavdevice-ffmpeg56Upgrade libpostproc-ffmpeg53Upgrade libavcodec57Upgrade libpostproc54Upgrade libswscale4Upgrade libavfilter-extra7Upgrade libavcodec-extra57Upgrade libavutil-ffmpeg54Upgrade libswresample-ffmpeg1Upgrade ffmpegUpgrade libavcodec-extra58Upgrade libavfilter-extra6Upgrade libavformat-ffmpeg56Upgrade libavutil55Upgrade libavresample4Upgrade libswscale5Upgrade libavcodec-ffmpeg-extra56Upgrade libswresample3Upgrade libavformat57Upgrade libavresample-ffmpeg2Upgrade libavcodec-ffmpeg56Upgrade libavfilter-ffmpeg5Upgrade libavresample3Upgrade libavdevice57Upgrade libavformat58 | Aug 5, 2020 | Jun 4, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub