CVE-2018-14395 — Divide By Zero in Ffmpeg

CWE-369 — Divide By Zero4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.8%
top 25.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
FfmpegDebian FfmpegDebian Linux
Timeline
PublishedJul 19
Latest updateMay 13

Description

libavformat/movenc.c in FFmpeg 3.2 and 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero error) with a user crafted audio file when converting to the MOV audio format.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/ffmpeg< ffmpeg 7:4.0.2-1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:4.0.2-1+3
▶NVDffmpeg/ffmpeg3.2, 4.0+1

Also affects: Debian Linux 9.0

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-wg9f-2mrx-wjp7: libavformat/movenc↗2022-05-13
▶
OSV
CVE-2018-14395: libavformat/movenc↗2018-07-19
▶

📋Vendor Advisories

1
Debian
CVE-2018-14395: ffmpeg - libavformat/movenc.c in FFmpeg 3.2 and 4.0.2 allows attackers to cause a denial ...↗2018
▶