CVE-2019-11339 - The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data

Back Back to CVE browser

HIGH

The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data

Published Apr 18, 2019

8.8

HIGH

CVSS 3.0

EPSS 2.75%

Description

The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (6)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00012.html
vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/108037
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3020
Advisory
https://github.com/FFmpeg/FFmpeg/commit/1f686d023b95219db933394a7704ad9aa5f01cbb
x_refsource_MISCPatchThird Party Advisory
https://github.com/FFmpeg/FFmpeg/commit/d227ed5d598340e719eff7156b1aa0a4469e9a6a
x_refsource_MISCPatchThird Party Advisory
https://usn.ubuntu.com/3967-1/
vendor-advisoryx_refsource_UBUNTU

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00012.html		vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/108037		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3020		Advisory
https://github.com/FFmpeg/FFmpeg/commit/1f686d023b95219db933394a7704ad9aa5f01cbb		x_refsource_MISCPatchThird Party Advisory
https://github.com/FFmpeg/FFmpeg/commit/d227ed5d598340e719eff7156b1aa0a4469e9a6a		x_refsource_MISCPatchThird Party Advisory
https://usn.ubuntu.com/3967-1/		vendor-advisoryx_refsource_UBUNTU

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Apr 18, 2019

Updated Aug 4, 2024

Reserved Apr 18, 2019

Link CVE-2019-11339

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-11339

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Apr 18, 2019

Updated Aug 4, 2024

Link EUVD-2019-3020

GitHub

No data