A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handle_open_brace in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 22, 2024 | Mar 12, 2019 |
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Mar 12, 2019 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.1.2 | Mar 14, 2019 | Mar 12, 2019 |
| Suse | — | Upgrade libavfilter6-32bitUpgrade libavdevice57-32bitUpgrade libswresample-develUpgrade libpostproc54Upgrade libpostproc-develUpgrade libpostproc54-32bitUpgrade libswscale-develUpgrade libswscale4Upgrade libavutil55Upgrade libswscale4-32bitUpgrade libavformat57-32bitUpgrade ffmpeg-private-develUpgrade libavresample-develUpgrade libavresample3-64bitUpgrade libswresample2-32bitUpgrade libavutil-develUpgrade libavcodec57-32bitUpgrade libavfilter6Upgrade libavcodec57Upgrade libavcodec-develUpgrade libswresample2Upgrade libavutil55-32bitUpgrade libavdevice57Upgrade libavresample3Upgrade libavdevice-develUpgrade libavformat57Upgrade libavresample3-32bitUpgrade libavfilter-develUpgrade libavformat-develUpgrade ffmpeg | Sep 3, 2021 | Mar 12, 2019 |
| Ubuntu | — | Upgrade libavdevice57Upgrade libavcodec57Upgrade libavformat57Upgrade ffmpegUpgrade libavresample4Upgrade libavfilter-extra6Upgrade libswscale4Upgrade libavutil56Upgrade libavfilter7Upgrade libavdevice58Upgrade libavcodec58Upgrade libavfilter-extra7Upgrade libswresample2Upgrade libavresample3Upgrade libavutil55Upgrade libswresample3Upgrade libavcodec-extra58Upgrade libavformat58Upgrade libswscale5Upgrade libavcodec-extra57Upgrade libpostproc54Upgrade libavfilter6Upgrade libpostproc55 | May 7, 2019 | Mar 12, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub