CVE-2019-11338

Published: Apr 19, 2019Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.

Affected (10)

Products: Ffmpeg: Ffmpeg · Debian: Debian Linux · Novell: Suse Package Hub For Suse Linux Enterprise · +1 more

Show all products

Ffmpeg: Ffmpeg · Debian: Debian Linux · Novell: Suse Package Hub For Suse Linux Enterprise · Canonical: Ubuntu Linux

1 product

1 product

1 product

Suse Package Hub For Suse Linux Enterprise

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Ffmpeg Ffmpeg	Version 3.4
Ffmpeg Ffmpeg	Version 4.1.2

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Novell Suse Package Hub For Suse Linux Enterprise	Version 12

Configuration D

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 18.10
Canonical Ubuntu Linux	Version 19.04
Canonical Ubuntu Linux	Version 20.04

Related CWEs

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (18)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00012.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/108034

Source: cve@mitre.org

Broken Link

https://github.com/FFmpeg/FFmpeg/commit/54655623a82632e7624714d7b2a3e039dc5faa7e

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/FFmpeg/FFmpeg/commit/9ccc633068c6fe76989f487c8932bd11886ad65b

Source: cve@mitre.org

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2019/05/msg00043.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2019/May/60

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://usn.ubuntu.com/3967-1/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4431-1/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2019/dsa-4449

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00012.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/108034

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

https://github.com/FFmpeg/FFmpeg/commit/54655623a82632e7624714d7b2a3e039dc5faa7e

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/FFmpeg/FFmpeg/commit/9ccc633068c6fe76989f487c8932bd11886ad65b

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2019/05/msg00043.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2019/May/60

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://usn.ubuntu.com/3967-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4431-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2019/dsa-4449

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.