In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg4Upgrade ffmpeg | Aug 22, 2024 | Mar 12, 2019 |
| Debian | — | Upgrade ffmpeg | May 23, 2019 | Mar 12, 2019 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.1.2 | Mar 14, 2019 | Mar 12, 2019 |
| Suse | — | Upgrade libavutil-develUpgrade libpostproc-develUpgrade libswresample-develUpgrade libavcodec-develUpgrade libpostproc54Upgrade libavfilter6Upgrade libavdevice57Upgrade libavresample3Upgrade libswscale-develUpgrade libavformat57Upgrade libavformat-develUpgrade ffmpegUpgrade libavresample-develUpgrade libavutil55Upgrade libswscale4Upgrade libavcodec57Upgrade libswresample2 | Feb 4, 2022 | Mar 12, 2019 |
| Ubuntu | — | Upgrade libavcodec-extra57Upgrade ffmpegUpgrade libavformat57Upgrade libavfilter-extra7Upgrade libswscale5Upgrade libswresample2Upgrade libavutil56Upgrade libavfilter6Upgrade libavcodec58Upgrade libavdevice58Upgrade libswscale4Upgrade libavresample3Upgrade libpostproc55Upgrade libavdevice57Upgrade libavutil55Upgrade libavresample4Upgrade libavfilter-extra6Upgrade libavcodec57Upgrade libpostproc54Upgrade libavfilter7Upgrade libavformat58Upgrade libswresample3Upgrade libavcodec-extra58 | May 7, 2019 | Mar 12, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub