CVE-2019-9721

Published: 12 March 2019

A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handle_open_brace in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.

Priority

CVSS 3 base score: 6.5

Status

Package	Release	Status
ffmpeg Launchpad, Ubuntu, Debian	Upstream	Needs triage




	Ubuntu 18.04 LTS (Bionic Beaver)	Released (7:3.4.6-0ubuntu0.18.04.1)
	Ubuntu 16.04 ESM (Xenial Xerus)	Not vulnerable (code not present)
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9721
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/894995c41e0795c7a44f81adc4838dedc3932e65
https://ubuntu.com/security/notices/USN-3967-1
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›

CVE-2019-9721

Medium

Status

References

Join the discussion

Canonical is offering Extended Security Maintenance

Further reading