CVE-2018-13302 - In FFmpeg 4.0.1, improper handling of frame types (other than EAC3_FRAME_TYPE_INDEPENDENT) that have multiple independent substreams in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to a denial of service or possibly unspecified other impact

Back Back to CVE browser

HIGH

In FFmpeg 4.0.1, improper handling of frame types (other than EAC3_FRAME_TYPE_INDEPENDENT) that have multiple independent substreams in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to a denial of service or possibly unspecified other impact

Published Jul 5, 2018

8.8

HIGH

CVSS 3.0

EPSS 2.18%

Description

In FFmpeg 4.0.1, improper handling of frame types (other than EAC3_FRAME_TYPE_INDEPENDENT) that have multiple independent substreams in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to a denial of service or possibly unspecified other impact.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-129

References (4)

http://www.securityfocus.com/bid/104675
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-5250
Advisory
https://github.com/FFmpeg/FFmpeg/commit/ed22dc22216f74c75ee7901f82649e1ff725ba50
x_refsource_MISCPatch
https://www.debian.org/security/2018/dsa-4249
vendor-advisoryx_refsource_DEBIANThird Party Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/104675		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-5250		Advisory
https://github.com/FFmpeg/FFmpeg/commit/ed22dc22216f74c75ee7901f82649e1ff725ba50		x_refsource_MISCPatch
https://www.debian.org/security/2018/dsa-4249		vendor-advisoryx_refsource_DEBIANThird Party Advisory