PT-2019-5883 · FFmpeg+4 · Ffmpeg+4
Published
2019-08-11
·
Updated
2026-02-06
·
CVE-2019-17542
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
FFmpeg versions prior to 4.2
Description
The issue is related to a heap-based buffer overflow in the
vqa decode chunk function due to an out-of-array access in the vqa decode init function in libavcodec/vqavideo.c. This can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.Recommendations
For versions prior to 4.2, update to version 4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the
vqa decode chunk function until a patch is available.Fix
Improper Validation of Array Index
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Ffmpeg
Linuxmint
Suse
Ubuntu