In FFmpeg 4.0.1, improper handling of frame types (other than EAC3_FRAME_TYPE_INDEPENDENT) that have multiple independent substreams in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to a denial of service or possibly unspecified other impact.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpegUpgrade ffmpeg4 | Aug 30, 2018 | Jul 5, 2018 |
| Debian | — | Upgrade ffmpeg | Jul 19, 2018 | Jul 5, 2018 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.0.2Upgrade to FFmpeg version 3.0.12Upgrade to FFmpeg version 4.1Upgrade to FFmpeg version 3.4.3Upgrade to FFmpeg version 3.3.8Upgrade to FFmpeg version 2.8.15Upgrade to FFmpeg version 3.2.11 | Jul 19, 2018 | Jul 5, 2018 |
| Suse | — | Upgrade libpostproc-develUpgrade libswresample2Upgrade libavfilter6Upgrade libswresample-develUpgrade libavformat-develUpgrade libswscale4Upgrade libavformat57Upgrade libswscale-develUpgrade libavresample-develUpgrade ffmpegUpgrade libavresample3Upgrade libpostproc54Upgrade libavutil55Upgrade libavcodec57Upgrade libavcodec-develUpgrade libavdevice57Upgrade libavutil-devel | Feb 4, 2022 | Jul 5, 2018 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Jul 5, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub