PT-2018-2293 · FFmpeg+2 · Ffmpeg+2

Alexandru Razvan Caciulescu + 3 · Publicado 2018-06-27 · Atualizado 2026-02-06 · CVE-2018-13302

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 4.0.1

Description The issue is related to the improper handling of frame types, other than EAC3 FRAME TYPE INDEPENDENT, that have multiple independent substreams in the handle eac3 function. This may trigger an out-of-array access while converting a crafted AVI file to MPEG4, potentially leading to a denial of service or allowing a remote attacker to execute arbitrary code using a specially crafted AVI file.

Recommendations For FFmpeg version 4.0.1, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Improper Validation of Array Index

Enumeração de Fraquezas

CWE-129

CWE-19

Identificadores relacionados

ALT-PU-2018-2047

BDU:2019-00420

CLEANSTART-2026-EZ98723

CLEANSTART-2026-PS82605

CLEANSTART-2026-XE32069

CVE-2018-13302

DSA-4249-1

MGASA-2018-0319

SUSE-SU-2018:2305-1

SUSE-SU-2018_2305-1

Produtos afetados

Alt Linux

Ffmpeg

Suse

Referências · 154

• https://github.com/FFmpeg/FFmpeg/commit/ed22dc22216f74c75ee7901f82649e1ff725ba50 · Correção
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PS82605 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PS82605.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EZ98723.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EZ98723 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-XE32069.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-7751 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000016 · Nota de Segurança
• https://bugzilla.suse.com/1102689 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-13302 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1999010 · Nota
• https://osv.dev/vulnerability/CVE-2021-38291 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-9718 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-13304 · Nota
• https://osv.dev/vulnerability/CVE-2020-24020 · Nota