The decode_init function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out of array read) via an AVI file.

The remote host is affected by the vulnerability described in GLSA-202003-65 (FFmpeg: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FFmpeg. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user or automated system using FFmpeg       to process a specially crafted file, resulting in the execution of       arbitrary code or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in the FFmpeg multimedia framework, which could result in denial of service or potentially the execution of arbitrary code if malformed files/streams are processed.

ID	Name	Product	Family	Severity
135020	GLSA-202003-65 : FFmpeg: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
111141	Debian DSA-4249-1 : ffmpeg - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-10001

medium

Tenable Plugins

critical

high