PT-2019-4945 · FFmpeg+3 · Ffmpeg+3

Publicado 2019-02-15 · Atualizado 2026-02-06 · CVE-2019-11339

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg versions 4.0 through 4.0.3 FFmpeg versions 4.1 through 4.1.1

Description The issue is related to the studio profile decoder in the libavcodec/mpeg4videodec.c file, which allows remote attackers to cause a denial of service or possibly have other impacts via crafted MPEG-4 video data. The vulnerability is also described as being related to the mpeg4 decode studio block() function, which is associated with out-of-array access due to buffer boundary reading issues. This can be exploited by an attacker using specially crafted MPEG-4 video data to cause a denial of service.

Recommendations For FFmpeg versions 4.0 through 4.0.3, update to version 4.0.4 or later. For FFmpeg versions 4.1 through 4.1.1, update to version 4.1.2 or later.

Correção

DoS

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

ALT-PU-2019-1505

BDU:2020-01557

CLEANSTART-2026-EZ98723

CLEANSTART-2026-PS82605

CLEANSTART-2026-XE32069

CVE-2019-11339

OPENSUSE-SU-2020:0024-1

OPENSUSE-SU-2020_0024-1

USN-3967-1

Produtos afetados

Alt Linux

Ffmpeg

Suse

Ubuntu

Referências · 154

• https://github.com/FFmpeg/FFmpeg/commit/d227ed5d598340e719eff7156b1aa0a4469e9a6a · Correção
• https://github.com/FFmpeg/FFmpeg/commit/1f686d023b95219db933394a7704ad9aa5f01cbb · Correção
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PS82605 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PS82605.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EZ98723.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EZ98723 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-XE32069.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-7751 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000016 · Nota de Segurança
• https://usn.ubuntu.com/3967-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-17555 · Nota
• https://ubuntu.com/security/CVE-2019-9721 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1999010 · Nota
• https://osv.dev/vulnerability/CVE-2021-38291 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-9718 · Nota de Segurança