cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg4Upgrade ffmpeg | Aug 22, 2024 | Apr 28, 2020 |
| Debian | — | Upgrade ffmpeg | Jul 10, 2020 | Apr 28, 2020 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.1.6Upgrade to FFmpeg version 4.2.3Upgrade to FFmpeg version 4.3 | May 6, 2020 | Apr 28, 2020 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Jul 29, 2020 | Apr 28, 2020 |
| Ubuntu | — | Upgrade libavcodec58Upgrade libavresample3Upgrade libavcodec-extra57Upgrade libavcodec-ffmpeg56Upgrade libswresample3Upgrade libswscale5Upgrade libavfilter6Upgrade libavdevice57Upgrade libavfilter-extra7Upgrade libavutil56Upgrade libavcodec57Upgrade libavdevice58Upgrade libswresample2Upgrade libavfilter-ffmpeg5Upgrade libpostproc55Upgrade libavformat57Upgrade libavresample4Upgrade libavformat-ffmpeg56Upgrade libpostproc-ffmpeg53Upgrade libpostproc54Upgrade libswscale4Upgrade libavfilter7Upgrade libavresample-ffmpeg2Upgrade libavcodec-ffmpeg-extra56Upgrade ffmpegUpgrade libavcodec-extra58Upgrade libswscale-ffmpeg3Upgrade libavutil55Upgrade libavformat58Upgrade libswresample-ffmpeg1Upgrade libavfilter-extra6Upgrade libavdevice-ffmpeg56Upgrade libavutil-ffmpeg54 | Aug 5, 2020 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub