The decode_plane function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The decode_plane function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to
    cause a denial of service (out of array read) via a crafted AVI file. (CVE-2018-6912)

  - Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux
    kernel through 4.15.7 allows local users to cause a denial of service (memory consumption) via many read
    accesses to files in the /sys/class/sas_phy directory, as demonstrated by the
    /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file. (CVE-2018-7757)

  - The export function in libavfilter/vf_signature.c in FFmpeg through 3.4.2 allows remote attackers to cause
    a denial of service (out-of-array access) or possibly have unspecified other impact via a long filename.
    (CVE-2018-9841)

The remote host is affected by the vulnerability described in GLSA-202003-65 (FFmpeg: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FFmpeg. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user or automated system using FFmpeg       to process a specially crafted file, resulting in the execution of       arbitrary code or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Type	Severity
426581	Alpine: ffmpeg4: security update to 4.0.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
426581	Alpine: ffmpeg4: security update to 4.0.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
404307	Alpine: multiple ffmpeg packages: security update to 4.0.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
404307	Alpine: multiple ffmpeg packages: security update to 4.0.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
135020	GLSA-202003-65 : FFmpeg: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical

Detections

Analytics

CVE-2018-6912

medium

Tenable Plugins

high

high

high

high

critical