NULL pointer dereference in FFmpeg - CVE-2019-17539

Vulnerability identifier: #VU29633

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-17539

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a NULL pointer dereference error within the avcodec_open2 in libavcodec/utils.c in in FFmpeg. A remote attacker can pass specially crafted media content to the affected application and perform a denial of service (DoS) attack or execute arbitrary code on the system.

Successful exploitation of the vulnerability may allows an attacker to compromise the affected system.

FFmpeg
Gentoo Linux
Ubuntu
ffmpeg (Alpine package)
ffmpeg (Debian package)
libswscale-ffmpeg3 (Ubuntu package)
libavcodec-ffmpeg-extra56 (Ubuntu package)
libavcodec-ffmpeg56 (Ubuntu package)
libavdevice-ffmpeg56 (Ubuntu package)
libavfilter-ffmpeg5 (Ubuntu package)
libavformat-ffmpeg56 (Ubuntu package)
libavresample-ffmpeg2 (Ubuntu package)
ffmpeg (Ubuntu package)
libavutil-ffmpeg54 (Ubuntu package)
libpostproc-ffmpeg53 (Ubuntu package)
libswresample-ffmpeg1 (Ubuntu package)
libavdevice57 (Ubuntu package)
libswscale4 (Ubuntu package)
libswresample2 (Ubuntu package)
libpostproc54 (Ubuntu package)
libavutil55 (Ubuntu package)
libavresample3 (Ubuntu package)
libavformat57 (Ubuntu package)
libavfilter6 (Ubuntu package)
libavfilter-extra6 (Ubuntu package)
libavcodec57 (Ubuntu package)
libavcodec-extra57 (Ubuntu package)
libpostproc55 (Ubuntu package)
libavutil56 (Ubuntu package)
libavresample4 (Ubuntu package)
libavformat58 (Ubuntu package)
libavfilter7 (Ubuntu package)
libavfilter-extra7 (Ubuntu package)
libavdevice58 (Ubuntu package)
libavcodec58 (Ubuntu package)
libavcodec-extra58 (Ubuntu package)
libswresample3 (Ubuntu package)
libswscale5 (Ubuntu package)

Install update from vendor's website.

FFmpeg - update to 4.2
ffmpeg (Alpine package) - update to 4.0.6-r0
ffmpeg (Debian package) - update to 7:4.1.6-1~deb10u1
libswscale-ffmpeg3 (Ubuntu package) - update to 7:2.8.17-0ubuntu0.1
libavcodec-ffmpeg-extra56 (Ubuntu package) - update to 7:2.8.17-0ubuntu0.1
libavcodec-ffmpeg56 (Ubuntu package) - update to 7:2.8.17-0ubuntu0.1
libavdevice-ffmpeg56 (Ubuntu package) - update to 7:2.8.17-0ubuntu0.1
libavfilter-ffmpeg5 (Ubuntu package) - update to 7:2.8.17-0ubuntu0.1
libavformat-ffmpeg56 (Ubuntu package) - update to 7:2.8.17-0ubuntu0.1
libavresample-ffmpeg2 (Ubuntu package) - update to 7:2.8.17-0ubuntu0.1
ffmpeg (Ubuntu package) - addressed in versions 7:2.8.17-0ubuntu0.1, 7:3.4.8-0ubuntu0.2, 7:4.2.4-1ubuntu0.1
libavutil-ffmpeg54 (Ubuntu package) - update to 7:2.8.17-0ubuntu0.1
libpostproc-ffmpeg53 (Ubuntu package) - update to 7:2.8.17-0ubuntu0.1
libswresample-ffmpeg1 (Ubuntu package) - update to 7:2.8.17-0ubuntu0.1
libavdevice57 (Ubuntu package) - update to 7:3.4.8-0ubuntu0.2
libswscale4 (Ubuntu package) - update to 7:3.4.8-0ubuntu0.2
libswresample2 (Ubuntu package) - update to 7:3.4.8-0ubuntu0.2
libpostproc54 (Ubuntu package) - update to 7:3.4.8-0ubuntu0.2
libavutil55 (Ubuntu package) - update to 7:3.4.8-0ubuntu0.2
libavresample3 (Ubuntu package) - update to 7:3.4.8-0ubuntu0.2
libavformat57 (Ubuntu package) - update to 7:3.4.8-0ubuntu0.2
libavfilter6 (Ubuntu package) - update to 7:3.4.8-0ubuntu0.2
libavfilter-extra6 (Ubuntu package) - update to 7:3.4.8-0ubuntu0.2
libavcodec57 (Ubuntu package) - update to 7:3.4.8-0ubuntu0.2
libavcodec-extra57 (Ubuntu package) - update to 7:3.4.8-0ubuntu0.2
libpostproc55 (Ubuntu package) - update to 7:4.2.4-1ubuntu0.1
libavutil56 (Ubuntu package) - update to 7:4.2.4-1ubuntu0.1
libavresample4 (Ubuntu package) - update to 7:4.2.4-1ubuntu0.1
libavformat58 (Ubuntu package) - update to 7:4.2.4-1ubuntu0.1
libavfilter7 (Ubuntu package) - update to 7:4.2.4-1ubuntu0.1
libavfilter-extra7 (Ubuntu package) - update to 7:4.2.4-1ubuntu0.1
libavdevice58 (Ubuntu package) - update to 7:4.2.4-1ubuntu0.1
libavcodec58 (Ubuntu package) - update to 7:4.2.4-1ubuntu0.1
libavcodec-extra58 (Ubuntu package) - update to 7:4.2.4-1ubuntu0.1
libswresample3 (Ubuntu package) - update to 7:4.2.4-1ubuntu0.1
libswscale5 (Ubuntu package) - update to 7:4.2.4-1ubuntu0.1

• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15733
• https://github.com/FFmpeg/FFmpeg/commit/8df6884832ec413cf032dfaa45c23b1c7876670c
• https://security.gentoo.org/glsa/202003-65
• https://www.debian.org/security/2020/dsa-4722

• Remote code execution in FFmpeg
• Debian update for ffmpeg
• NULL pointer dereference in ffmpeg (Alpine package)
• Gentoo update for FFmpeg
• Ubuntu update for ffmpeg