CVE-2019-11338
Fixed in a distro release EPSS 2%
libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.
Products: ffmpeg, debian_linux, novell suse_package_hub_for_suse_linux_enterprise, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ffmpeg | 7:4.1.3-1 |
| Debian 13 | ffmpeg | 7:4.1.3-1 |
| Debian 14 | ffmpeg | 7:4.1.3-1 |
| Debian 8 | libav | 6:11.12-1~deb8u7 |
| Debian 9 | ffmpeg | 7:3.2.14-1~deb9u1 |
| SUSE Package Hub 12 SP2 | ffmpeg-4 | 4.2.1-bp151.5.3.1 |
| SUSE Package Hub 15 | ffmpeg-4 | 4.2.1-bp151.5.3.1 |
| SUSE Package Hub 15 SP1 | ffmpeg-4 | 4.2.1-bp151.5.3.1 |
| Ubuntu 16.04 LTS | ffmpeg | 7:2.8.17-0ubuntu0.1 |
| Ubuntu 18.04 LTS | ffmpeg | 7:3.4.6-0ubuntu0.18.04.1 |
| Ubuntu 18.04 LTS | ffmpeg | 7:3.4.8-0ubuntu0.2 |
| Ubuntu 20.04 LTS | ffmpeg | 7:4.2.4-1ubuntu0.1 |
| openSUSE Leap 15.1 | ffmpeg-4 | 4.2.1-bp151.5.3.1 |
| openSUSE Tumbleweed | ffmpeg-4 | 4.4-5.2 |