PT-2019-3436 · FFmpeg+4 · Ffmpeg+4

Chamal De Silva · Publicado 2019-05-22 · Atualizado 2026-02-06 · CVE-2019-12730

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 3.2.14 FFmpeg versions 4.x prior to 4.1.4

Description The issue is related to the lack of error checking in the sscanf function in the libavformat library of the FFmpeg multimedia environment. This can lead to the use of uninitialized variables. Exploitation of this issue may allow a remote attacker to compromise data integrity, gain unauthorized access to protected information, and cause a denial of service.

Recommendations For FFmpeg versions prior to 3.2.14, update to version 3.2.14 or later. For FFmpeg versions 4.x prior to 4.1.4, update to version 4.1.4 or later. As a temporary workaround, consider restricting access to the aa read header function in libavformat/aadec.c until a patch is available.

Correção

Improper Initialization

Use of Uninitialized Resource

Enumeração de Fraquezas

CWE-665

CWE-908

Identificadores relacionados

ALT-PU-2019-2328

ALT-PU-2019-3126

BDU:2019-03593

CLEANSTART-2026-EZ98723

CLEANSTART-2026-PS82605

CLEANSTART-2026-XE32069

CVE-2019-12730

DSA-4449-1

DSA-4502-1

SUSE-SU-2019:3184-1

SUSE-SU-2019:3184-2

USN-4431-1

Produtos afetados

Alt Linux

Ffmpeg

Linuxmint

Suse

Ubuntu

Referências · 167

• https://github.com/FFmpeg/FFmpeg/commit/ed188f6dcdf0935c939ed813cf8745d50742014b · Correção
• https://github.com/FFmpeg/FFmpeg/compare/a97ea53...ba11e40 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PS82605 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PS82605.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EZ98723.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EZ98723 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-XE32069.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-7751 · Nota de Segurança
• https://bugzilla.suse.com/1137526 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000016 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12730 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1999010 · Nota
• https://osv.dev/vulnerability/CVE-2021-38291 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-9718 · Nota de Segurança
• https://bugzilla.suse.com/1100352 · Nota