CVE-2018-1999014 Denial of service in n/a

Medium 6.5 Published 23 Jul 2018 Updated 5 Aug 2024

An out-of-bounds array access in the FFmpeg MXF demuxer allows attackers to cause a denial of service via a specially crafted file.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2018-1999014?

CVE-2018-1999014 is a medium-severity denial of service vulnerability in Ffmpeg Ffmpeg, published on 23 Jul 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can result in DoS. This attack appear to be exploitable via specially crafted MXF file which has to be provided as input. This vulnerability appears to have been fixed in bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 and later.

Weakness: CWE-125

Which versions are affected by CVE-2018-1999014?

It affects 1 product.

Products include Ffmpeg Ffmpeg.

How do I fix CVE-2018-1999014?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2018-1999014 being exploited?

There is no known exploitation of CVE-2018-1999014 in the wild and no public exploit code.

All Ffmpeg Ffmpeg vulnerabilities

Sources

Also known as CLEANSTART-2024-MH90303, DEBIAN-CVE-2018-1999014, GHSA-vw6x-3gg6-qxm3, UBUNTU-CVE-2018-1999014.