Assertion violation in FFmpeg - CVE-2018-12458
Published: July 23, 2018 / Updated: July 26, 2018
Vulnerability identifier: #VU14017
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-12458
CWE-ID: CWE-617
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to improper integer type in the mpeg4_encode_gop_header function in libavcodec/mpeg4videoenc.c. A remote attacker can supply specially crafted AVI file to MPEG4, trick the victim into converting it, trigger assertion violation and cause the service to crash.
Affected software
FFmpeg
Debian Linux
ffmpeg (Alpine package)
Debian Linux
ffmpeg (Alpine package)
How to mitigate CVE-2018-12458
Update to version 4.0.1.
FFmpeg - update to 4.0.1
ffmpeg (Alpine package) - update to 3.4.4-r0
ffmpeg (Alpine package) - update to 3.4.4-r0