In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg4Upgrade ffmpeg | Aug 22, 2024 | Mar 12, 2019 |
| Debian | — | Upgrade ffmpeg | May 23, 2019 | Mar 12, 2019 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.1.2 | Mar 14, 2019 | Mar 12, 2019 |
| Suse | — | Upgrade libavresample3Upgrade libswresample2Upgrade libavcodec57Upgrade ffmpegUpgrade libavutil55Upgrade libavresample-develUpgrade libswscale4Upgrade libswscale-develUpgrade libavdevice57Upgrade libavformat-develUpgrade libavformat57Upgrade libpostproc54Upgrade libswresample-develUpgrade libavcodec-develUpgrade libavfilter6Upgrade libpostproc-develUpgrade libavutil-devel | Feb 4, 2022 | Mar 12, 2019 |
| Ubuntu | — | Upgrade libavfilter-extra6Upgrade libavformat58Upgrade libavutil55Upgrade libavcodec-extra58Upgrade libpostproc54Upgrade libswresample3Upgrade libavcodec57Upgrade libavresample4Upgrade libavdevice57Upgrade libavfilter7Upgrade libswresample2Upgrade libswscale5Upgrade libavdevice58Upgrade libavcodec58Upgrade libavfilter6Upgrade libswscale4Upgrade ffmpegUpgrade libavformat57Upgrade libavcodec-extra57Upgrade libavfilter-extra7Upgrade libavresample3Upgrade libpostproc55Upgrade libavutil56 | May 7, 2019 | Mar 12, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub