CVE-2019-9718

Published: 12 March 2019

In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.

Priority

CVSS 3 base score: 6.5

Status

Package	Release	Status
ffmpeg Launchpad, Ubuntu, Debian	Upstream	Needs triage




	Ubuntu 18.04 LTS (Bionic Beaver)	Released (7:3.4.6-0ubuntu0.18.04.1)
	Ubuntu 16.04 ESM (Xenial Xerus)	Not vulnerable (code not present)
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9718
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/1f00c97bc3475c477f3c468cf2d924d5761d0982
https://ubuntu.com/security/notices/USN-3967-1
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›

CVE-2019-9718

Medium

Status

References

Join the discussion

Canonical is offering Extended Security Maintenance

Further reading