cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 22, 2024 | Apr 28, 2020 |
| Debian | — | Upgrade ffmpeg | Jul 10, 2020 | Apr 28, 2020 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.3Upgrade to FFmpeg version 4.1.6Upgrade to FFmpeg version 4.2.3 | May 6, 2020 | Apr 28, 2020 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Jul 29, 2020 | Apr 28, 2020 |
| Ubuntu | — | Upgrade libavdevice-ffmpeg56Upgrade libavfilter7Upgrade libavformat58Upgrade libavcodec58Upgrade libswscale5Upgrade libpostproc55Upgrade libavresample3Upgrade libavcodec-extra57Upgrade libswresample3Upgrade libavutil56Upgrade libswresample2Upgrade libavfilter-extra7Upgrade libavfilter-ffmpeg5Upgrade libavdevice57Upgrade libavformat57Upgrade libavfilter6Upgrade libavdevice58Upgrade libavcodec57Upgrade libavcodec-ffmpeg56Upgrade libswscale-ffmpeg3Upgrade libswresample-ffmpeg1Upgrade libavresample-ffmpeg2Upgrade libpostproc54Upgrade libswscale4Upgrade ffmpegUpgrade libpostproc-ffmpeg53Upgrade libavcodec-extra58Upgrade libavresample4Upgrade libavutil55Upgrade libavutil-ffmpeg54Upgrade libavcodec-ffmpeg-extra56Upgrade libavformat-ffmpeg56Upgrade libavfilter-extra6 | Aug 5, 2020 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub