CVE-2018-1999013 Use after free in n/a

Medium 6.5 Published 23 Jul 2018 Updated 5 Aug 2024

An attacker can read heap memory by providing a specially crafted RM file to FFmpeg, potentially exposing sensitive data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2018-1999013?

CVE-2018-1999013 is a medium-severity use after free vulnerability in Ffmpeg Ffmpeg, published on 23 Jul 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later.

Weakness: CWE-416

Which versions are affected by CVE-2018-1999013?

It affects 1 product.

Products include Ffmpeg Ffmpeg.

How do I fix CVE-2018-1999013?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2018-1999013 being exploited?

There is no known exploitation of CVE-2018-1999013 in the wild and no public exploit code.

All Ffmpeg Ffmpeg vulnerabilities

Sources

Also known as CLEANSTART-2024-LM99875, DEBIAN-CVE-2018-1999013, GHSA-74ff-r9q5-73vp, UBUNTU-CVE-2018-1999013.