PT-2018-3998 · FFmpeg+2 · Ffmpeg+2

Paul Ch · Publicado 2018-07-05 · Atualizado 2026-02-06 · CVE-2018-1999012

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 9807d3976be0e92e4ece3b4b1701be894cd7c2e1

Description The issue is related to an infinite loop vulnerability in the pva format demuxer. This can be exploited by providing a specially crafted PVA file as input, allowing attackers to consume excessive amounts of resources like CPU and RAM, potentially leading to a denial of service. The vulnerability can be exploited remotely.

Recommendations For versions prior to 9807d3976be0e92e4ece3b4b1701be894cd7c2e1, update to a version that includes the fix, such as 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 or later. As a temporary workaround, consider restricting the use of the pva format demuxer to minimize the risk of exploitation. Avoid using the pva format demuxer with untrusted input files until the issue is resolved.

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

ALT-PU-2018-2047

BDU:2024-09058

CLEANSTART-2026-EZ98723

CLEANSTART-2026-PS82605

CLEANSTART-2026-XE32069

CVE-2018-1999012

DLA-1740-1

DSA-4249-1

SUSE-SU-2018:2305-1

Produtos afetados

Alt Linux

Ffmpeg

Suse

Referências · 151

• https://github.com/FFmpeg/FFmpeg/commit/9807d3976be0e92e4ece3b4b1701be894cd7c2e1 · Correção
• https://github.com/FFmpeg/FFmpeg/commit/9807d3976be0e92e4ece3b4b1701be894cd7c2e · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PS82605 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PS82605.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EZ98723.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EZ98723 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-XE32069.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-7751 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000016 · Nota de Segurança
• https://bugzilla.suse.com/1102689 · Nota
• https://osv.dev/vulnerability/CVE-2018-1999010 · Nota
• https://osv.dev/vulnerability/CVE-2021-38291 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-9718 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-13304 · Nota
• https://osv.dev/vulnerability/CVE-2020-24020 · Nota