CVE-2019-9721 — MEDIUM (6.5)

Vulnerability Description

A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handle_open_brace in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Ffmpeg	Ffmpeg	3.2
Canonical	Ubuntu Linux	18.04

Related Weaknesses (CWE)

CWE-125

References

http://www.securityfocus.com/bid/107384Broken Link
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/894995c41e0795c7a44f81adc4838dedMailing ListPatchThird Party Advisory
https://github.com/FFmpeg/FFmpeg/commit/273f2755ce8635d42da3cde0eeba15b2e7842774PatchThird Party Advisory
https://usn.ubuntu.com/3967-1/Third Party Advisory
http://www.securityfocus.com/bid/107384Broken Link
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/894995c41e0795c7a44f81adc4838dedMailing ListPatchThird Party Advisory
https://github.com/FFmpeg/FFmpeg/commit/273f2755ce8635d42da3cde0eeba15b2e7842774PatchThird Party Advisory
https://usn.ubuntu.com/3967-1/Third Party Advisory

FAQ

What is CVE-2019-9721?

CVE-2019-9721 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handle_open_brace in libavcodec/htmlsubtitles.c h...

How severe is CVE-2019-9721?

CVE-2019-9721 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-9721?

Check the references section above for vendor advisories and patch information. Affected products include: Ffmpeg Ffmpeg, Canonical Ubuntu Linux.