cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg4Upgrade ffmpeg | Aug 22, 2024 | Apr 28, 2020 |
| Debian | — | Upgrade ffmpeg | Jul 10, 2020 | Apr 28, 2020 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.2.3Upgrade to FFmpeg version 4.1.6Upgrade to FFmpeg version 4.3 | May 6, 2020 | Apr 28, 2020 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Jul 29, 2020 | Apr 28, 2020 |
| Ubuntu | — | Upgrade libavcodec-ffmpeg56Upgrade libavfilter-extra7Upgrade libavfilter-ffmpeg5Upgrade libavcodec-extra57Upgrade libavresample3Upgrade libavutil56Upgrade libswresample3Upgrade libpostproc55Upgrade libavdevice58Upgrade libavdevice57Upgrade libswscale5Upgrade libswresample2Upgrade libavformat57Upgrade libavcodec58Upgrade libavcodec57Upgrade libavfilter6Upgrade libavdevice-ffmpeg56Upgrade libavresample-ffmpeg2Upgrade ffmpegUpgrade libpostproc-ffmpeg53Upgrade libavfilter7Upgrade libswscale4Upgrade libavformat-ffmpeg56Upgrade libpostproc54Upgrade libavcodec-ffmpeg-extra56Upgrade libavcodec-extra58Upgrade libavutil55Upgrade libavutil-ffmpeg54Upgrade libavresample4Upgrade libavformat58Upgrade libswscale-ffmpeg3Upgrade libswresample-ffmpeg1Upgrade libavfilter-extra6 | Aug 5, 2020 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub