CVE-2018-14394 — Divide By Zero in Ffmpeg

CWE-369 — Divide By Zero5 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.5%
top 35.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
FfmpegDebian Ffmpeg
Timeline
PublishedJul 19
Latest updateMay 14

Description

libavformat/movenc.c in FFmpeg before 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero error) with a user crafted Waveform audio file.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDffmpeg/ffmpeg< 4.0.2
▶debiandebian/ffmpeg< ffmpeg 7:4.0.2-1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:4.0.2-1+3

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-8279-9gqq-prr4: libavformat/movenc↗2022-05-14
▶
OSV
CVE-2018-14394: libavformat/movenc↗2018-07-19
▶

📋Vendor Advisories

1
Debian
CVE-2018-14394: ffmpeg - libavformat/movenc.c in FFmpeg before 4.0.2 allows attackers to cause a denial o...↗2018
▶

📄Research Papers

1
arXiv
Too Quiet in the Library: An Empirical Study of Security Updates in Android Apps' Native Code↗2021-03-03
▶