CVE-2018-6912 — Out-of-bounds Read in Ffmpeg

CWE-125 — Out-of-bounds Read4 documents4 sources

Severity

6.5MEDIUMNVD

EPSS

0.7%

top 28.01%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Ffmpeg Debian Ffmpeg

Timeline

PublishedFeb 12

Latest updateMay 13

Description

The decode_plane function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/ffmpeg< ffmpeg 7:4.0.1-2 (bookworm)

▶Debianffmpeg/ffmpeg< 7:4.0.1-2+3

▶NVDffmpeg/ffmpeg3.4.2

🔴Vulnerability Details

GHSA

GHSA-j5r6-hg62-36xj: The decode_plane function in libavcodec/utvideodec↗2022-05-13

▶

OSV

CVE-2018-6912: The decode_plane function in libavcodec/utvideodec↗2018-02-12

▶

📋Vendor Advisories

Debian

CVE-2018-6912: ffmpeg - The decode_plane function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 all...↗2018

▶