Use-after-free in ffmpeg.sourceforge.net FFmpeg



| Updated: 2020-07-28
Risk Medium
Patch available NO
Number of vulnerabilities 1
CVE-ID CVE-2018-1999013
CWE-ID CWE-416
Exploitation vector Network
Public exploit N/A
Vulnerable software
 FFmpeg
Universal components / Libraries / Libraries used by multiple products

Vendor ffmpeg.sourceforge.net

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Use-after-free

EUVDB-ID: #VU32008

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-1999013

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later. A attacker to read heap memory. This attack appear can be exploitable.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

FFmpeg: 0.29

CPE2.3 External links

https://www.securityfocus.com/bid/104896
https://github.com/FFmpeg/FFmpeg/commit/a7e032a277452366771951e29fd0bf2bd5c029f0


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###