CVSS: 9.8EPSS: 0%CPEs: 11EXPL: 0CVE-2019-17542 – Debian Security Advisory 4722-1
https://notcve.org/view.php?id=CVE-2019-17542
14 Oct 2019 — FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c. FFmpeg versiones anteriores a 4.2, presenta un desbordamiento de búfer en la región heap de la memoria en la función vqa_decode_chunk debido a un acceso fuera de la matriz en la función vqa_decode_init en el archivo libavcodec/vqavideo.c. It was discovered that FFmpeg incorrectly verified empty audio packets or HEVC data. An attacker could possibly use this is... • https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15919 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-15942 – Gentoo Linux Security Advisory 202007-58
https://notcve.org/view.php?id=CVE-2019-15942
05 Sep 2019 — FFmpeg through 4.2 has a "Conditional jump or move depends on uninitialised value" issue in h2645_parse because alloc_rbsp_buffer in libavcodec/h2645_parse.c mishandles rbsp_buffer. FFmpeg hasta la versión 4.2 tiene un problema de "Conditional jump or move depends on uninitialised value" en h2645_parse porque alloc_rbsp_buffer en libavcodec/h2645_parse.c gestiona de manera incorrecta rbsp_buffer. Multiple vulnerabilities have been found in FFmpeg, the worst of which could result in the arbitrary execution o... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00012.html • CWE-252: Unchecked Return Value •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-13390 – Debian Security Advisory 4722-1
https://notcve.org/view.php?id=CVE-2019-13390
07 Jul 2019 — In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c. En FFmpeg versión 4.1.3, hay una división por cero en adx_write_trailer en libavformat/rawenc.c. It was discovered that FFmpeg incorrectly verified empty audio packets or HEVC data. An attacker could possibly use this issue to cause a denial of service via a crafted file. This issue only affected Ubuntu 16.04 LTS, as it was already fixed in Ubuntu 18.04 LTS. • http://www.securityfocus.com/bid/109090 • CWE-369: Divide By Zero •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-13312 – Gentoo Linux Security Advisory 202007-58
https://notcve.org/view.php?id=CVE-2019-13312
05 Jul 2019 — block_cmp() in libavcodec/zmbvenc.c in FFmpeg 4.1.3 has a heap-based buffer over-read. block_cmp() in libavcodec/zmbvenc.c en FFmpeg versión 4.1.3 tiene una sobrelectura de búfer basada en memoria dinámica (heap) It was discovered that FFmpeg incorrectly verified empty audio packets or HEVC data. An attacker could possibly use this issue to cause a denial of service via a crafted file. This issue only affected Ubuntu 16.04 LTS, as it was already fixed in Ubuntu 18.04 LTS. • https://security.gentoo.org/glsa/202003-65 • CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2019-12730 – Debian Security Advisory 4502-1
https://notcve.org/view.php?id=CVE-2019-12730
04 Jun 2019 — aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables. aa_read_header en libavformat / aadec.c en FFmpeg en versiones anteriores a la 3.2.14 y versión 4.x versiones anteriores a la 4.1.4 no verifica el error de sscanf y, por lo tanto, permite el uso de variables sin inicializar. It was discovered that FFmpeg incorrectly verified empty audio packets or HEVC data. An attacker could possibly us... • http://www.securityfocus.com/bid/109317 • CWE-908: Use of Uninitialized Resource •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-11339
https://notcve.org/view.php?id=CVE-2019-11339
18 Apr 2019 — The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data. Studio profile decoder en libavcodec/mpeg4videodec.c en FFmpeg versiones 4.0 anteriores a 4.0.4 y 4.1 anteriores a 4.1.2 permite a los atacantes remotos causar una denegación de servicio (out-of-array access) o posiblemente tener otro impacto no especificado ... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00012.html • CWE-125: Out-of-bounds Read •
CVSS: 8.8EPSS: 1%CPEs: 10EXPL: 0CVE-2019-11338 – Debian Security Advisory 4449-1
https://notcve.org/view.php?id=CVE-2019-11338
18 Apr 2019 — libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data. libavcodec/hevcdec.c en FFmpeg versión 3.4 y versión 4.1.2 maneja de forma incorrecta la detección de los primeros cortes duplicados, lo que permite a los atacantes remotos causar una denegación de servicio (desreferencia de puntero NULL y acce... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00012.html • CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2019-9718 – Debian Security Advisory 4449-1
https://notcve.org/view.php?id=CVE-2019-9718
12 Mar 2019 — In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf. En FFmpeg, versión 3.2 y 4.1, una denegación de servicio en el decodificador de subtítulos permite a los atacantes acaparar la CPU mediante un archivo de vídeo manipulado en formato Matroska, debido a que ff_htmlmarkup_to_ass en libavcodec/htmlsubtitles.c tiene un arg... • http://www.securityfocus.com/bid/107382 • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2019-9721 – Ubuntu Security Notice USN-3967-1
https://notcve.org/view.php?id=CVE-2019-9721
12 Mar 2019 — A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handle_open_brace in libavcodec/htmlsubtitles.c has a complex format argument to sscanf. Una denegación de servicio en el decodificador de subtítulos en FFmpeg versión 3.2 y 4.1 permite a los atacantes acaparar la CPU a través de un archivo de vídeo elaborado en formato Matroska, porque handle_open_brace en libavcodec/htmlsubtitles.c tiene un argumento de for... • http://www.securityfocus.com/bid/107384 • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-1000016
https://notcve.org/view.php?id=CVE-2019-1000016
04 Feb 2019 — FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs_av1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in after commit b97a4b658814b2de8b9f2a3bce491c002d34de31. FFMPEG 4.1 contiene una vulnerabilidad CWE-129: validación incorrecta del índice de arrays en libavcodec/cbs_av1.c que puede resultar en una denegación de servi... • https://github.com/FFmpeg/FFmpeg/commit/b97a4b658814b2de8b9f2a3bce491c002d34de31#diff-cd7e24986650014d67f484f3ffceef3f • CWE-129: Improper Validation of Array Index •