Detections
Analytics
Alpine: multiple ffmpeg packages: security update to 4.0.4-r0
high Tenable Cloud Security Plugin ID 404310
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty
audio packet, leading to an assertion failure. (CVE-2018-15822)
- In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a
crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a
complex format argument to sscanf. (CVE-2019-9718)
- A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a
crafted video file in Matroska format, because handle_open_brace in libavcodec/htmlsubtitles.c has a
complex format argument to sscanf. (CVE-2019-9721)
- The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2
allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified
other impact via crafted MPEG-4 video data. (CVE-2019-11339)
See Also
https://security.alpinelinux.org/vuln/CVE-2018-15822
https://security.alpinelinux.org/vuln/CVE-2019-11339
Plugin Details
Severity: High
ID: 404310
Version: Revision 1.25
Type: Local
Published: 10/31/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.12
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2019-11339
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 8/23/2018
Reference Information
CVE: CVE-2018-15822, CVE-2019-11339, CVE-2019-9718, CVE-2019-9721