FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in av_probe_input_format3 in libavformat/format.c.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 22, 2024 | Jun 7, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 7, 2020 |
| Debian | — | Upgrade ffmpeg | Jul 10, 2020 | Jun 7, 2020 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.1.6Upgrade to FFmpeg version 3.2.15Upgrade to FFmpeg version 2.8.17Upgrade to FFmpeg version 4.0.6Upgrade to FFmpeg version 4.4Upgrade to FFmpeg version 4.3.1Upgrade to FFmpeg version 4.2.4Upgrade to FFmpeg version 3.4.8 | Jun 15, 2020 | Jun 7, 2020 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Jul 29, 2020 | Jun 7, 2020 |
| Suse | — | Upgrade libpostproc-develUpgrade libavformat-develUpgrade libavresample-develUpgrade libavresample3-32bitUpgrade libavresample3Upgrade libavformat57Upgrade libavdevice57Upgrade libavfilter-develUpgrade libswscale4Upgrade libavdevice-develUpgrade libavutil55-32bitUpgrade libswresample2Upgrade libavcodec-develUpgrade libswscale4-32bitUpgrade libavcodec57Upgrade libavutil-develUpgrade libavformat57-32bitUpgrade libpostproc54-32bitUpgrade ffmpeg-private-develUpgrade libswscale-develUpgrade libavfilter6Upgrade ffmpegUpgrade libavutil55Upgrade libavfilter6-32bitUpgrade libavcodec57-32bitUpgrade libpostproc54Upgrade libswresample-develUpgrade libavdevice57-32bitUpgrade libswresample2-32bit | Jul 15, 2021 | Jun 7, 2020 |
| Ubuntu | — | Upgrade libavresample3Upgrade libavcodec58Upgrade libswresample3Upgrade libpostproc-ffmpeg53Upgrade libavcodec-extra57Upgrade ffmpegUpgrade libavfilter-extra6Upgrade libavformat57Upgrade libpostproc55Upgrade libavfilter-extra7Upgrade libavdevice58Upgrade libavcodec-ffmpeg-extra56Upgrade libavfilter6Upgrade libavfilter-ffmpeg5Upgrade libavresample-ffmpeg2Upgrade libswresample2Upgrade libavdevice57Upgrade libswresample-ffmpeg1Upgrade libavfilter7Upgrade libavformat58Upgrade libavresample4Upgrade libpostproc54Upgrade libavutil55Upgrade libavutil-ffmpeg54Upgrade libswscale4Upgrade libswscale5Upgrade libavformat-ffmpeg56Upgrade libavcodec-ffmpeg56Upgrade libavcodec57Upgrade libswscale-ffmpeg3Upgrade libavdevice-ffmpeg56Upgrade libavcodec-extra58Upgrade libavutil56 | Aug 5, 2020 | Jun 7, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub