cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg4Upgrade ffmpeg | Aug 22, 2024 | Apr 28, 2020 |
| Debian | — | Upgrade ffmpeg | Jul 10, 2020 | Apr 28, 2020 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.3Upgrade to FFmpeg version 4.1.6Upgrade to FFmpeg version 4.2.3 | May 6, 2020 | Apr 28, 2020 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Jul 29, 2020 | Apr 28, 2020 |
| Ubuntu | — | Upgrade libavcodec-ffmpeg56Upgrade libavcodec58Upgrade libswresample3Upgrade libavfilter-extra7Upgrade libavcodec-extra57Upgrade libavresample3Upgrade libavutil56Upgrade libavcodec57Upgrade libavdevice57Upgrade libpostproc55Upgrade libavformat57Upgrade libavdevice58Upgrade libswresample2Upgrade libavfilter-ffmpeg5Upgrade libswscale5Upgrade libavfilter6Upgrade ffmpegUpgrade libavdevice-ffmpeg56Upgrade libswresample-ffmpeg1Upgrade libavutil-ffmpeg54Upgrade libavcodec-extra58Upgrade libavformat-ffmpeg56Upgrade libavfilter7Upgrade libswscale-ffmpeg3Upgrade libswscale4Upgrade libavresample-ffmpeg2Upgrade libavfilter-extra6Upgrade libavutil55Upgrade libpostproc54Upgrade libpostproc-ffmpeg53Upgrade libavformat58Upgrade libavcodec-ffmpeg-extra56Upgrade libavresample4 | Aug 5, 2020 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub