SB2018072321 - Out-of-bounds read in ffmpeg.sourceforge.net FFmpeg
Published: July 23, 2018 Updated: July 28, 2020
Security Bulletin ID
SB2018072321
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Out-of-bounds read (CVE-ID: CVE-2018-1999014)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can result in DoS. This attack appear to be exploitable via specially crafted MXF file which has to be provided as input. This vulnerability appears to have been fixed in bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 and later.
Remediation
Install update from vendor's website.