CVE-2020-20450
FFmpeg 4.2 is affected by null pointer dereference passed as argument to libavformat/aviobuf.c, which could cause a Denial of Service.
- Обновитесь до 7:4.4-5
Опубликовано Обновлено
PatchFirst · Свежие уязвимости
Уязвимости ffmpeg · Страница 10
За последние 30 дней в ffmpeg опубликовано уязвимостей: 10; в каталоге KEV: 0.
Уязвимостей: 433
CVE-2020-20448
FFmpeg 4.1.3 is affected by a Divide By Zero issue via libavcodec/ratecontrol.c, which allows a remote malicious user to cause a Denial of Service.
- Обновитесь до 7:4.3-2
Опубликовано ОбновленоCVE-2020-20446
FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aacpsy.c, which allows a remote malicious user to cause a Denial of Service.
- Обновитесь до 7:4.4.1-1
Опубликовано ОбновленоCVE-2020-20445
FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/lpc.h, which allows a remote malicious user to cause a Denial of Service.
- Обновитесь до 7:5.0.1-2
Опубликовано ОбновленоCVE-2020-21041
Buffer Overflow vulnerability exists in FFmpeg 4.1 via apng_do_inverse_blend in libavcodec/pngenc.c, which could let a remote malicious user cause a Denial of Service
- Обновитесь до 7:4.3.2-0+deb11u2
Опубликовано ОбновленоCVE-2020-35965
decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations.
- Обновитесь до 7:4.3.1-6
Опубликовано ОбновленоCVE-2020-35964
track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing.
- Обновитесь до 7:4.3.1-6
Опубликовано ОбновленоCVE-2020-14212
FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because dnn_backend_native.c calls ff_dnn_load_model_native and a certain index check is omitted.
- Обновитесь до 7:4.3.1-1
Опубликовано ОбновленоCVE-2020-13904
FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in av_probe_input_format3 in libavformat/format.c.
- Обновитесь до 7:4.3.1-1
Опубликовано ОбновленоCVE-2020-12284
cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.
- Обновитесь до 7:4.2.3-1
Опубликовано ОбновленоCVE-2014-4610
Integer overflow in the get_len function in libavutil/lzo.c in FFmpeg before 0.10.14, 1.1.x before 1.1.12, 1.2.x before 1.2.7, 2.0.x before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.4 allows remote attackers to execute arbitrary code via a crafted Literal Run.
- Обновитесь до 7:2.4.1-1
Опубликовано ОбновленоCVE-2019-17539
In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.
- Обновитесь до 7:4.2.1-1
Опубликовано ОбновленоCVE-2019-17542
FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c.
- Обновитесь до 7:4.2.1-1
Опубликовано ОбновленоCVE-2019-13390
In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.
- Обновитесь до 7:4.2.1-1
Опубликовано ОбновленоCVE-2019-12730
aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables.
- Обновитесь до 7:4.1.4-1
Опубликовано ОбновленоCVE-2019-11339
The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data.
- Обновитесь до 7:4.1.3-1
Опубликовано ОбновленоCVE-2019-11338
libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.
- Обновитесь до 7:4.1.3-1
Опубликовано ОбновленоCVE-2019-9721
A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handle_open_brace in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.
- Обновитесь до 7:4.1.3-1
Опубликовано ОбновленоCVE-2019-9718
In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.
- Обновитесь до 7:4.1.3-1
Опубликовано ОбновленоCVE-2019-1000016
FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs_av1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in after commit b97a4b658814b2de8b9f2a3bce491c002d34de31.
- Обновитесь до 7:4.1.1-1
Опубликовано Обновлено
Проверьте свой сервер
Сопоставьте установленный стек и версии со свежими базами уязвимостей.