libavformat/movenc.c in FFmpeg 3.2 and 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero error) with a user crafted audio file when converting to the MOV audio format.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - libavformat/movenc.c in FFmpeg 3.2 and 4.0.2 allows attackers to cause a denial of service (application
    crash caused by a divide-by-zero error) with a user crafted audio file when converting to the MOV audio
    format. (CVE-2018-14395)

This update for ffmpeg fixes the following issues :

Security issue fixed :

CVE-2018-14395: Fixed a divide-by-zero error in libavformat/movenc.c that allowed attackers to cause a DoS (bsc#1101889)

CVE-2018-14394: Fixed a divide-by-zero error in libavformat/movenc.c that allowed attackers to cause a DoS (bsc#1101888).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the FFmpeg multimedia framework, which could result in denial of service or potentially the execution of arbitrary code if malformed files/streams are processed.

ID	Name	Product	Family	Severity
426863	Alpine: ffmpeg4: security update to 3.4.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
426863	Alpine: ffmpeg4: security update to 3.4.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
404305	Alpine: multiple ffmpeg packages: security update to 3.4.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
404305	Alpine: multiple ffmpeg packages: security update to 3.4.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
129878	SUSE SLED15 / SLES15 Security Update : ffmpeg (SUSE-SU-2019:1299-2)	Nessus	SuSE Local Security Checks	medium
125334	SUSE SLED15 / SLES15 Security Update : ffmpeg (SUSE-SU-2019:1299-1)	Nessus	SuSE Local Security Checks	medium
111396	Debian DSA-4258-1 : ffmpeg - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2018-14395

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium