PT-2018-3402 · FFmpeg+4 · Ffmpeg+4

Chen Hongxu · Published 2018-08-23 · Updated 2026-02-06 · CVE-2018-15822

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: FFmpeg versions through 2.8

Description: The issue is related to the flv write packet function in the FFmpeg library, which lacks a check for an empty audio packet. This can lead to an assertion failure. Exploitation of this issue may allow a remote attacker to cause a denial of service.

Recommendations: For FFmpeg versions through 2.8, consider updating to a version that includes a fix for this issue, as the current version may allow for a denial of service attack due to the lack of checking for empty audio packets in the flv write packet function.

Fix

Assertion Failure

RCE

Weakness Enumeration

CWE-617

CWE-20

Related Identifiers

ALT-PU-2018-2593

BDU:2020-00758

CLEANSTART-2026-EZ98723

CLEANSTART-2026-PS82605

CLEANSTART-2026-XE32069

CVE-2018-15822

DLA-1809-1

DSA-4449-1

MGASA-2019-0029

MGASA-2019-0223

OPENSUSE-SU-2018_2723-1

OPENSUSE-SU-2019:1066-1

OPENSUSE-SU-2024:10754-1

SUSE-SU-2018:3609-1

USN-3967-1

USN-4431-1

Affected Products

Alt Linux

Ffmpeg

Linuxmint

Suse

Ubuntu

References · 226

• https://github.com/FFmpeg/FFmpeg/commit/d8ecb335fe4852bbc172c7b79e66944d158b4d92 · Patch
• https://github.com/FFmpeg/FFmpeg/commit/6b67d7f05918f7a1ee8fc6ff21355d7e8736aa10 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2018:3609-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999012 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-9841 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-13301 · Security Note
• https://ubuntu.com/security/CVE-2019-17542 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-20453 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3965 · Security Note
• https://ubuntu.com/security/CVE-2019-11339 · Vendor Advisory
• https://usn.ubuntu.com/3967-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38171 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999015 · Security Note
• https://advisories.mageia.org/MGASA-2019-0029.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-14394 · Security Note