CVE-2018-1999013 — Use After Free in Ffmpeg

CWE-416 — Use After Free4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.3%
top 42.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
FfmpegDebian Ffmpeg
Timeline
PublishedJul 23
Latest updateMay 14

Description

FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/ffmpeg< ffmpeg 7:4.0.2-1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:4.0.2-1+3
▶NVDffmpeg/ffmpeg4.0.1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-74ff-r9q5-73vp: FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vuln↗2022-05-14
▶
OSV
CVE-2018-1999013: FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vuln↗2018-07-23
▶

📋Vendor Advisories

1
Debian
CVE-2018-1999013: ffmpeg - FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-aft...↗2018
▶