CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

CVE details

CVE-2018-1999011

FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asf_o format demuxer that can result in heap-buffer-overflow that may result in remote code execution. This attack appears to be exploitable via specially crafted ASF file that has to be provided as input to FFmpeg. This vulnerability appears to have been fixed in 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 and later.

Score
8.8 high
Published
2018-07-23
Links
NVD · cve.org

Affected ports (1)

PortPackageVersionStatusMaintainer
multimedia/ffmpeg3ffmpeg33.0.2_1unaddressedkreinholz@gmail.com

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>ffmpeg3</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains
	a Buffer Overflow vulnerability in asf_o format demuxer that can
	result in heap-buffer-overflow that may result in remote code
	execution. This attack appears to be exploitable via specially crafted
	ASF file that has to be provided as input to FFmpeg. This
	vulnerability appears to have been fixed in
	2b46ebdbff1d8dec7a3d8ea280a612b91a582869 and later.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2018-1999011</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2018-1999011</url>
    </references>
    <dates>
      <discovery>2018-07-23</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>