PT-2019-3436 · FFmpeg+4 · Ffmpeg+4

Chamal De Silva · Published 2019-05-22 · Updated 2026-02-06 · CVE-2019-12730

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 3.2.14 FFmpeg versions 4.x prior to 4.1.4

Description The issue is related to the lack of error checking in the sscanf function in the libavformat library of the FFmpeg multimedia environment. This can lead to the use of uninitialized variables. Exploitation of this issue may allow a remote attacker to compromise data integrity, gain unauthorized access to protected information, and cause a denial of service.

Recommendations For FFmpeg versions prior to 3.2.14, update to version 3.2.14 or later. For FFmpeg versions 4.x prior to 4.1.4, update to version 4.1.4 or later. As a temporary workaround, consider restricting access to the aa read header function in libavformat/aadec.c until a patch is available.

Fix

Improper Initialization

Use of Uninitialized Resource

Weakness Enumeration

CWE-665

CWE-908

Related Identifiers

ALT-PU-2019-2328

ALT-PU-2019-3126

BDU:2019-03593

CLEANSTART-2026-EZ98723

CLEANSTART-2026-PS82605

CLEANSTART-2026-XE32069

CVE-2019-12730

DSA-4449-1

DSA-4502-1

SUSE-SU-2019:3184-1

SUSE-SU-2019:3184-2

USN-4431-1

Affected Products

Alt Linux

Ffmpeg

Linuxmint

Suse

Ubuntu

References · 167

• https://github.com/FFmpeg/FFmpeg/commit/ed188f6dcdf0935c939ed813cf8745d50742014b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-7751 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000016 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12730 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9718 · Security Note
• https://usn.ubuntu.com/4431-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12458 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999010 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-13305 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-13904 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-13302 · Security Note
• https://debian.org/security/2019/dsa-4502 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35965 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-12284 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999011 · Security Note