CVE-2018-1999015 Information disclosure in n/a

Medium 6.5 Published 23 Jul 2018 Updated 5 Aug 2024

An out-of-bounds read in FFmpeg's ASF demuxer allows attackers to read heap memory via a crafted file, potentially exposing sensitive data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2018-1999015?

CVE-2018-1999015 is a medium-severity vulnerability in Ffmpeg Ffmpeg, published on 23 Jul 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

FFmpeg before commit 5aba5b89d0b1d73164d3b81764828bb8b20ff32a contains an out of array read vulnerability in ASF_F format demuxer that can result in heap memory reading. This attack appear to be exploitable via specially crafted ASF file that has to provided as input. This vulnerability appears to have been fixed in 5aba5b89d0b1d73164d3b81764828bb8b20ff32a and later.

Weakness: CWE-125

Which versions are affected by CVE-2018-1999015?

It affects 1 product.

Products include Ffmpeg Ffmpeg.

How do I fix CVE-2018-1999015?

Apply the vendor's patch.

Is CVE-2018-1999015 being exploited?

There is no known exploitation of CVE-2018-1999015 in the wild and no public exploit code.

All Ffmpeg Ffmpeg vulnerabilities

Sources

Also known as CLEANSTART-2024-DO03307, DEBIAN-CVE-2018-1999015, GHSA-w6mf-f4jp-73hm, UBUNTU-CVE-2018-1999015.