In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg4Upgrade ffmpeg | Aug 22, 2024 | Mar 12, 2019 |
| Debian | — | Upgrade ffmpeg | May 23, 2019 | Mar 12, 2019 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.1.2 | Mar 14, 2019 | Mar 12, 2019 |
| Suse | — | Upgrade libavutil-develUpgrade libswresample-develUpgrade libavfilter6Upgrade libpostproc-develUpgrade libpostproc54Upgrade libavcodec-develUpgrade libswresample2Upgrade ffmpegUpgrade libavcodec57Upgrade libswscale-develUpgrade libavdevice57Upgrade libavformat57Upgrade libavformat-develUpgrade libavutil55Upgrade libswscale4Upgrade libavresample3Upgrade libavresample-devel | Feb 4, 2022 | Mar 12, 2019 |
| Ubuntu | — | Upgrade libavdevice57Upgrade libavutil55Upgrade libavresample4Upgrade libavcodec57Upgrade libavfilter7Upgrade libpostproc54Upgrade libavcodec-extra58Upgrade libswresample3Upgrade libavformat58Upgrade libavfilter-extra6Upgrade libpostproc55Upgrade libswresample2Upgrade libavresample3Upgrade libavcodec-extra57Upgrade libswscale4Upgrade libavformat57Upgrade libswscale5Upgrade libavfilter-extra7Upgrade libavutil56Upgrade libavcodec58Upgrade libavfilter6Upgrade libavdevice58Upgrade ffmpeg | May 7, 2019 | Mar 12, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub