Use After Free in Ffmpeg
CVE-2018-1999013
FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later.
Vulnerability class: Use-After-Free
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.018 (76.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 76.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.018 · newest: 0.018 · change: -0.000
Affected products
Weakness classification (CWE)
References
- www.securityfocus.com/bid/104896 (VDB Entry, Third Party Advisory, vdb-entry)
- github.com/FFmpeg/FFmpeg/commit/a7e032a277452366771951e29fd0bf2bd5c029f0 (Patch, Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2018-1999013?
- CVE-2018-1999013 is a medium-severity vulnerability in Ffmpeg, classified under Use After Free. CVSS score: 6.5/10. Published 2018-07-23.
- How severe is CVE-2018-1999013?
- Medium severity. CVSS v3 base score is 6.5 out of 10.