PT-2018-4000 · FFmpeg+2 · Ffmpeg+2
Chen Hongxu
·
Published
2018-07-08
·
Updated
2026-02-06
·
CVE-2018-14394
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
FFmpeg versions prior to 4.0.2
Description
The issue is related to a divide-by-zero error in the libavformat/movenc.c component of the FFmpeg library, which can be triggered by a user-crafted Waveform audio file. This can cause a denial of service, resulting in an application crash. The vulnerability is associated with a lack of division by zero checking, allowing a remote attacker to exploit it and cause a service disruption.
Recommendations
For versions prior to 4.0.2, update to version 4.0.2 or later to resolve the issue. As a temporary workaround, consider avoiding the use of user-crafted Waveform audio files until the update is applied.
Fix
DoS
Divide By Zero
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Ffmpeg
Suse