Input validation error in FFmpeg - CVE-2019-9718
Published: April 19, 2019
Vulnerability identifier: #VU18320
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-9718
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input within the subtitle decoder in ff_htmlmarkup_to_ass() function in libavcodec/htmlsubtitles.c when processing video files in Matroska format. A remote attacker can create a specially crafted video file, pass it to the affected application and consume all available CPU resources.
Affected software
FFmpeg
ffmpeg (Alpine package)
ffmpeg (Ubuntu package)
ffmpeg (Alpine package)
ffmpeg (Ubuntu package)
How to mitigate CVE-2019-9718
Install updates from vendor's website.
FFmpeg - update to 4.1.1
ffmpeg (Alpine package) - update to 3.4.6-r0
ffmpeg (Ubuntu package) - addressed in versions 7:3.4.6-0ubuntu0.18.04.1, 7:4.0.4-0ubuntu1, 7:4.1.3-0ubuntu1
ffmpeg (Alpine package) - update to 3.4.6-r0
ffmpeg (Ubuntu package) - addressed in versions 7:3.4.6-0ubuntu0.18.04.1, 7:4.0.4-0ubuntu1, 7:4.1.3-0ubuntu1