NULL pointer dereference in ffmpeg (Alpine package)

1) NULL pointer dereference

EUVDB-ID: #VU29633

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-17539

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a NULL pointer dereference error within the avcodec_open2 in libavcodec/utils.c in in FFmpeg. A remote attacker can pass specially crafted media content to the affected application and perform a denial of service (DoS) attack or execute arbitrary code on the system.

Successful exploitation of the vulnerability may allows an attacker to compromise the affected system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

ffmpeg (Alpine package): 0.5-r0 - 4.0.4-r0

CPE2.3

• cpe:2.3:a:alpine:ffmpeg_alpine_package:0.5-r0:*:*:*:*:alpine_linux:*:1.9
• cpe:2.3:a:alpine:ffmpeg_alpine_package:4.0.2-r0:*:*:*:*:alpine_linux:*:3.9
• cpe:2.3:a:alpine:ffmpeg_alpine_package:4.0.4-r0:*:*:*:*:alpine_linux:*:3.9

External links

https://git.alpinelinux.org/aports/commit/?id=228dc16f637162cbf1a241b4f1d71606ba5e8888
https://git.alpinelinux.org/aports/commit/?id=de8ecbcf01a07a78b3ef9f8970573d6e77803cd0
https://git.alpinelinux.org/aports/commit/?id=c0e9c2726f23f0410b383f030c4e2c8ab6b5090f

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.