CVE-2019-9718

 

Published at: - 12-03-2019 10:29

Last modified: - 07-10-2022 04:15

Total changes: - 2

Description

In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

 

Verification logic

 

Reference

• https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/1f00c97bc3475c477f3c468cf2d924d5761d0982
• 107382-Broken Link
• USN-3967-1-Third Party Advisory
• 20190523 [SECURITY] [DSA 4449-1] ffmpeg security update-Mailing List, Third Party Advisory
• DSA-4449-Third Party Advisory
• https://github.com/FFmpeg/FFmpeg/commit/23ccf3cabb4baf6e8af4b1af3fcc59c904736f21

 

Keywords

NVD

 

CVE-2019-9718

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures