PT-2019-4945 · FFmpeg+3 · Ffmpeg+3

Published 2019-02-15 · Updated 2026-02-06 · CVE-2019-11339

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg versions 4.0 through 4.0.3 FFmpeg versions 4.1 through 4.1.1

Description The issue is related to the studio profile decoder in the libavcodec/mpeg4videodec.c file, which allows remote attackers to cause a denial of service or possibly have other impacts via crafted MPEG-4 video data. The vulnerability is also described as being related to the mpeg4 decode studio block() function, which is associated with out-of-array access due to buffer boundary reading issues. This can be exploited by an attacker using specially crafted MPEG-4 video data to cause a denial of service.

Recommendations For FFmpeg versions 4.0 through 4.0.3, update to version 4.0.4 or later. For FFmpeg versions 4.1 through 4.1.1, update to version 4.1.2 or later.

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2019-1505

BDU:2020-01557

CLEANSTART-2026-EZ98723

CLEANSTART-2026-PS82605

CLEANSTART-2026-XE32069

CVE-2019-11339

OPENSUSE-SU-2020:0024-1

OPENSUSE-SU-2020_0024-1

USN-3967-1

Affected Products

Alt Linux

Ffmpeg

Suse

Ubuntu

References · 154

• https://github.com/FFmpeg/FFmpeg/commit/d227ed5d598340e719eff7156b1aa0a4469e9a6a · Patch
• https://github.com/FFmpeg/FFmpeg/commit/1f686d023b95219db933394a7704ad9aa5f01cbb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-7751 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000016 · Security Note
• https://usn.ubuntu.com/3967-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9721 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9718 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-12458 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999010 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-13305 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2020:0024-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13904 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-13302 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-35965 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-12284 · Security Note