CVE-2018-13300

In FFmpeg 3.2 and 4.0.1, an improper argument AVCodecParameters passed to the avprivrequestsample function in the handleeac3 function in libavformat/movenc.c may trigger an out-of-array read while converting a crafted AVI file to MPEG4, leading to a denial of service and possibly an information...

CVE-2018-13302

In FFmpeg 4.0.1, improper handling of frame types other than EAC3FRAMETYPEINDEPENDENT that have multiple independent substreams in the handleeac3 function in libavformat/movenc.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to a denial of service or...

CVE-2018-13304

In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studioprofile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to errorresilience.c, h263dec.c, and...

CVE-2018-13300

In FFmpeg 3.2 and 4.0.1, an improper argument AVCodecParameters passed to the avprivrequestsample function in the handleeac3 function in libavformat/movenc.c may trigger an out-of-array read while converting a crafted AVI file to MPEG4, leading to a denial of service and possibly an information...

CVE-2018-13301

In FFmpeg 4.0.1, due to a missing check of a profile value before setting it, the ffmpeg4decodepictureheader function in libavcodec/mpeg4videodec.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service...

CVE-2018-13305

In FFmpeg 4.0.1, due to a missing check for negative values of the mquant variable, the vc1putblocksclamped function in libavcodec/vc1block.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to an information disclosure or a denial of service...

CVE-2018-13302

CVE-2018-13302 affects FFmpeg 4.0.1 in the libavformat/movenc.c handle_eac3 path. A crafted AVI can trigger an out-of-bounds access when handling multiple independent substreams, leading to denial of service (and potentially other impacts as described in the entry). Public advisories note this vu...

CVE-2018-13305

In FFmpeg 4.0.1, due to a missing check for negative values of the mquant variable, the vc1putblocksclamped function in libavcodec/vc1block.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to an information disclosure or a denial of service...

CVE-2018-13303

In FFmpeg 4.0.1, a missing check for failure of a call to initgetbits8 in the avprivac3parseheader function in libavcodec/ac3parser.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service...

CVE-2018-13304

In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studioprofile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to errorresilience.c, h263dec.c, and...

CVE-2018-13302

In FFmpeg 4.0.1, improper handling of frame types other than EAC3FRAMETYPEINDEPENDENT that have multiple independent substreams in the handleeac3 function in libavformat/movenc.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to a denial of service or...

CVE-2018-13305

CVE-2018-13305 affects FFmpeg 4.x, where a missing check for negative mquant values in the VC-1 decoding path (vc1_put_blocks_clamped in libavcodec/vc1_block.c) can trigger an out-of-bounds access while converting a crafted AVI to MPEG-4, potentially causing information disclosure or a denial of ...

CVE-2018-13304

In FFmpeg 4.0.1, the vulnerability CVE-2018-13304 stems from improper maintenance of consistency between the context profile field and studio_profile in libavcodec. This can trigger an assertion failure during conversion of a crafted AVI file to MPEG-4, potentially causing a denial of service. Af...

CVE-2018-13301

CVE-2018-13301 affects FFmpeg 4.0.1. The vulnerability occurs in the libavcodec/mpeg4videodec.c function ff_mpeg4_decode_picture_header where there is a missing check of a profile value before setting it. This can trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, le...

CVE-2018-13300

Summary: CVE-2018-13300 affects FFmpeg 3.2 and 4.0.1. The vulnerability arises from an improper argument passed to avpriv_request_sample in handle_eac3 (libavformat/movenc.c), which may cause an out-of-bounds read while converting a crafted AVI file to MPEG4, leading to denial of service and pote...

CVE-2018-13301

In FFmpeg 4.0.1, due to a missing check of a profile value before setting it, the ffmpeg4decodepictureheader function in libavcodec/mpeg4videodec.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service...

CVE-2018-13303

In FFmpeg 4.0.1, a missing check for failure of a call to initgetbits8 in the avprivac3parseheader function in libavcodec/ac3parser.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service...

CVE-2018-13300

In FFmpeg 3.2 and 4.0.1, an improper argument AVCodecParameters passed to the avprivrequestsample function in the handleeac3 function in libavformat/movenc.c may trigger an out-of-array read while converting a crafted AVI file to MPEG4, leading to a denial of service and possibly an information...

ffmpeg/ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer: Heap-buffer-overflow in decode_dc_progressive

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5684770334834688 Project: ffmpeg Fuzzer: libFuzzerffmpegAVCODECIDJPEGLSfuzzer Fuzz target binary: ffmpegAVCODECIDJPEGLSfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type:...

ffmpeg/ffmpeg_AV_CODEC_ID_LIBVPX_VP8_fuzzer: Heap-use-after-free in av_packet_ref

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5768227253649408 Project: ffmpeg Fuzzer: libFuzzerffmpegAVCODECIDLIBVPXVP8fuzzer Fuzz target binary: ffmpegAVCODECIDLIBVPXVP8fuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type:...