In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a
    crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a
    complex format argument to sscanf. (CVE-2019-9718)

  - A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a
    crafted video file in Matroska format, because handle_open_brace in libavcodec/htmlsubtitles.c has a
    complex format argument to sscanf. (CVE-2019-9721)

  - libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows
    remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or
    possibly have unspecified other impact via crafted HEVC data. (CVE-2019-11338)

  - The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2
    allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified
    other impact via crafted MPEG-4 video data. (CVE-2019-11339)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty
    audio packet, leading to an assertion failure. (CVE-2018-15822)

  - In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a
    crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a
    complex format argument to sscanf. (CVE-2019-9718)

  - A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a
    crafted video file in Matroska format, because handle_open_brace in libavcodec/htmlsubtitles.c has a
    complex format argument to sscanf. (CVE-2019-9721)

  - The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2
    allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified
    other impact via crafted MPEG-4 video data. (CVE-2019-11339)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty
    audio packet, leading to an assertion failure. (CVE-2018-15822)

  - In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a
    crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a
    complex format argument to sscanf. (CVE-2019-9718)

  - A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a
    crafted video file in Matroska format, because handle_open_brace in libavcodec/htmlsubtitles.c has a
    complex format argument to sscanf. (CVE-2019-9721)

  - libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows
    remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or
    possibly have unspecified other impact via crafted HEVC data. (CVE-2019-11338)

This update for ffmpeg fixes the following issues :

Security issues fixed: CVE-2019-17542: Fixed a heap-buffer overflow in vqa_decode_chunk due to an out-of-array access (bsc#1154064).

CVE-2019-12730: Fixed an uninitialized use of variables due to an improper check (bsc#1137526).

CVE-2019-9718: Fixed a denial of service in the subtitle decode (bsc#1129715).

CVE-2018-13301: Fixed a denial of service while converting a crafted AVI file to MPEG4 (bsc#1100352).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ffmpeg fixes the following issues :

Security issues fixed :

CVE-2019-17542: Fixed a heap-buffer overflow in vqa_decode_chunk due to an out-of-array access (bsc#1154064).

CVE-2019-12730: Fixed an uninitialized use of variables due to an improper check (bsc#1137526).

CVE-2019-9718: Fixed a denial of service in the subtitle decode (bsc#1129715).

CVE-2018-13301: Fixed a denial of service while converting a crafted AVI file to MPEG4 (bsc#1100352).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the FFmpeg multimedia framework, which could result in denial of service or potentially the execution of arbitrary code if malformed files/streams are processed.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3967-1 advisory.

    It was discovered that FFmpeg contained multiple security issues when handling certain multimedia files.
    If a user were tricked into opening a crafted multimedia file, an attacker could cause a denial of service     via application crash.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
426442	Alpine: ffmpeg4: security update to 4.1.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
426442	Alpine: ffmpeg4: security update to 4.1.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404314	Alpine: multiple ffmpeg packages: security update to 4.1.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404314	Alpine: multiple ffmpeg packages: security update to 4.1.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404310	Alpine: multiple ffmpeg packages: security update to 4.0.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404310	Alpine: multiple ffmpeg packages: security update to 4.0.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404306	Alpine: multiple ffmpeg packages: security update to 3.4.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404306	Alpine: multiple ffmpeg packages: security update to 3.4.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
138253	SUSE SLED15 / SLES15 Security Update : ffmpeg (SUSE-SU-2019:3184-2)	Nessus	SuSE Local Security Checks	critical
131756	SUSE SLED15 / SLES15 Security Update : ffmpeg (SUSE-SU-2019:3184-1)	Nessus	SuSE Local Security Checks	critical
125344	Debian DSA-4449-1 : ffmpeg - security update	Nessus	Debian Local Security Checks	high
124678	Ubuntu 18.04 LTS : FFmpeg vulnerabilities (USN-3967-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2019-9718

medium

Tenable Plugins

high

high

high

high

high

high

high

high

critical

critical

high

high