cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 22, 2024 | Apr 28, 2020 |
| Debian | — | Upgrade ffmpeg | Jul 10, 2020 | Apr 28, 2020 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.2.3Upgrade to FFmpeg version 4.1.6Upgrade to FFmpeg version 4.3 | May 6, 2020 | Apr 28, 2020 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Jul 29, 2020 | Apr 28, 2020 |
| Ubuntu | — | Upgrade libswresample2Upgrade libavfilter6Upgrade libavfilter-ffmpeg5Upgrade libavutil56Upgrade libavformat57Upgrade libavcodec-ffmpeg56Upgrade libavdevice57Upgrade libavcodec57Upgrade libavdevice58Upgrade libpostproc55Upgrade libavcodec-extra57Upgrade libswresample3Upgrade libavcodec58Upgrade libavresample3Upgrade libswscale5Upgrade libavfilter-extra7Upgrade libavdevice-ffmpeg56Upgrade libpostproc54Upgrade libavformat-ffmpeg56Upgrade libswscale-ffmpeg3Upgrade libavcodec-extra58Upgrade libavcodec-ffmpeg-extra56Upgrade ffmpegUpgrade libpostproc-ffmpeg53Upgrade libavutil55Upgrade libavfilter7Upgrade libavfilter-extra6Upgrade libswscale4Upgrade libavformat58Upgrade libswresample-ffmpeg1Upgrade libavresample4Upgrade libavresample-ffmpeg2Upgrade libavutil-ffmpeg54 | Aug 5, 2020 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub