In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 22, 2024 | Mar 12, 2019 |
| Debian | — | Upgrade ffmpeg | May 23, 2019 | Mar 12, 2019 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.1.2 | Mar 14, 2019 | Mar 12, 2019 |
| Suse | — | Upgrade libswresample-develUpgrade libpostproc-develUpgrade libavfilter6Upgrade libavutil-develUpgrade libavcodec-develUpgrade libpostproc54Upgrade libswresample2Upgrade libswscale-develUpgrade libavutil55Upgrade libavresample-develUpgrade libavcodec57Upgrade libavformat57Upgrade libavformat-develUpgrade libavdevice57Upgrade ffmpegUpgrade libavresample3Upgrade libswscale4 | Feb 4, 2022 | Mar 12, 2019 |
| Ubuntu | — | Upgrade libavdevice58Upgrade libavformat57Upgrade libswresample2Upgrade libswscale5Upgrade libavfilter6Upgrade libavcodec-extra57Upgrade ffmpegUpgrade libpostproc55Upgrade libavutil56Upgrade libswscale4Upgrade libavcodec58Upgrade libavresample3Upgrade libavfilter-extra7Upgrade libpostproc54Upgrade libavcodec-extra58Upgrade libswresample3Upgrade libavcodec57Upgrade libavresample4Upgrade libavutil55Upgrade libavdevice57Upgrade libavformat58Upgrade libavfilter7Upgrade libavfilter-extra6 | May 7, 2019 | Mar 12, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub