In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg4Upgrade ffmpeg | Aug 22, 2024 | Mar 12, 2019 |
| Debian | — | Upgrade ffmpeg | May 23, 2019 | Mar 12, 2019 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.1.2 | Mar 14, 2019 | Mar 12, 2019 |
| Suse | — | Upgrade libswresample-develUpgrade libpostproc-develUpgrade libavutil-develUpgrade libavfilter6Upgrade libavcodec-develUpgrade libpostproc54Upgrade libswscale-develUpgrade libswscale4Upgrade libavutil55Upgrade libavformat-develUpgrade libavdevice57Upgrade libavformat57Upgrade ffmpegUpgrade libavresample3Upgrade libavresample-develUpgrade libavcodec57Upgrade libswresample2 | Feb 4, 2022 | Mar 12, 2019 |
| Ubuntu | — | Upgrade libpostproc54Upgrade libavcodec-extra58Upgrade libavutil55Upgrade libavresample4Upgrade libavfilter7Upgrade libavcodec57Upgrade libavfilter-extra6Upgrade libavformat58Upgrade libavdevice57Upgrade libswresample3Upgrade libpostproc55Upgrade libavresample3Upgrade libavcodec-extra57Upgrade libavcodec58Upgrade ffmpegUpgrade libavfilter-extra7Upgrade libavformat57Upgrade libavdevice58Upgrade libswscale5Upgrade libavutil56Upgrade libswresample2Upgrade libavfilter6Upgrade libswscale4 | May 7, 2019 | Mar 12, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub