CVE-2019-9718

CVE-2019-9718

Name

CVE-2019-9718

Description

In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.

NVD Severity

medium

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

Type	URI
Patch	https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/1f00c97bc3475c477f3c468cf2d924d5761d0982
Third Party Advisory	http://www.securityfocus.com/bid/107382
UBUNTU	https://usn.ubuntu.com/3967-1/
BUGTRAQ	https://seclists.org/bugtraq/2019/May/60
DEBIAN	https://www.debian.org/security/2019/dsa-4449
MISC	https://github.com/FFmpeg/FFmpeg/commit/23ccf3cabb4baf6e8af4b1af3fcc59c904736f21

Type

URI

Patch

https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/1f00c97bc3475c477f3c468cf2d924d5761d0982

Third Party Advisory

http://www.securityfocus.com/bid/107382

UBUNTU

https://usn.ubuntu.com/3967-1/

BUGTRAQ

https://seclists.org/bugtraq/2019/May/60

DEBIAN

https://www.debian.org/security/2019/dsa-4449