CVE-2018-1999014 — Out-of-bounds Read in Ffmpeg

CWE-125 — Out-of-bounds Read4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.4%
top 36.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
FfmpegDebian Ffmpeg
Timeline
PublishedJul 23
Latest updateMay 14

Description

FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can result in DoS. This attack appear to be exploitable via specially crafted MXF file which has to be provided as input. This vulnerability appears to have been fixed in bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 and later.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/ffmpeg< ffmpeg 7:4.0.2-1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:4.0.2-1+3
▶NVDffmpeg/ffmpeg4.0.1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-vw6x-3gg6-qxm3: FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can result in D↗2022-05-14
▶
OSV
CVE-2018-1999014: FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can result in D↗2018-07-23
▶

📋Vendor Advisories

1
Debian
CVE-2018-1999014: ffmpeg - FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of...↗2018
▶