CVE-2019-11338

libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.

References

Affected packages

Git / github.com/FFmpeg/FFmpeg

Affected ranges

Type

GIT

Repo

https://github.com/FFmpeg/FFmpeg

Events

Introduced

Last affected

22b0daa1b3f0ac5d91cc1a057d230995590847cd

Introduced

Last affected

a7cb7a2e4314956e06a351333ff8096fab9afa7f

Introduced

Last affected

140fd653aed8cad774f991ba083e2d01e86420c7

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.1.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.0"
        }
    ]
}

Type: GIT
Repo: https://github.com/ffmpeg/ffmpeg
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

54655623a82632e7624714d7b2a3e039dc5faa7e

Fixed

9ccc633068c6fe76989f487c8932bd11886ad65b

Affected versions

Other

ffmpeg-0.*

ffmpeg-0.6.3

n0.*

n0.10

n0.10.1

n0.10.10

n0.10.11

n0.10.12

n0.10.13

n0.10.14

n0.10.15

n0.10.16

n0.10.2

n0.10.3

n0.10.4

n0.10.5

n0.10.6

n0.10.7

n0.10.8

n0.10.9

n0.11

n0.11-dev

n0.11.1

n0.11.2

n0.11.3

n0.11.4

n0.11.5

n0.12-dev

n0.5.10

n0.5.11

n0.5.12

n0.5.13

n0.5.14

n0.5.15

n0.5.5

n0.5.6

n0.5.7

n0.5.8

n0.5.9

n0.6.4

n0.6.5

n0.6.6

n0.6.7

n0.7.1

n0.7.10

n0.7.11

n0.7.12

n0.7.13

n0.7.14

n0.7.15

n0.7.16

n0.7.17

n0.7.2

n0.7.3

n0.7.4

n0.7.5

n0.7.6

n0.7.7

n0.7.8

n0.7.9

n0.8

n0.8.1

n0.8.10

n0.8.11

n0.8.12

n0.8.13

n0.8.14

n0.8.15

n0.8.2

n0.8.3

n0.8.4

n0.8.5

n0.8.6

n0.8.7

n0.8.8

n0.8.9

n0.9

n0.9.1

n0.9.2

n0.9.3

n0.9.4

n1.*

n1.0

n1.0.1

n1.0.10

n1.0.2

n1.0.3

n1.0.4

n1.0.5

n1.0.6

n1.0.7

n1.0.8

n1.0.9

n1.1

n1.1-dev

n1.1.1

n1.1.10

n1.1.11

n1.1.12

n1.1.13

n1.1.14

n1.1.15

n1.1.16

n1.1.2

n1.1.3

n1.1.4

n1.1.5

n1.1.6

n1.1.7

n1.1.8

n1.1.9

n1.2

n1.2-dev

n1.2.1

n1.2.10

n1.2.11

n1.2.12

n1.2.2

n1.2.3

n1.2.4

n1.2.5

n1.2.6

n1.2.7

n1.2.8

n1.2.9

n1.3-dev

n2.*

n2.0

n2.0.1

n2.0.2

n2.0.3

n2.0.4

n2.0.5

n2.0.6

n2.0.7

n2.1

n2.1-dev

n2.1.1

n2.1.2

n2.1.3

n2.1.4

n2.1.5

n2.1.6

n2.1.7

n2.1.8

n2.2

n2.2-dev

n2.2-rc1

n2.2-rc2

n2.2.1

n2.2.10

n2.2.11

n2.2.12

n2.2.13

n2.2.14

n2.2.15

n2.2.16

n2.2.2

n2.2.3

n2.2.4

n2.2.5

n2.2.6

n2.2.7

n2.2.8

n2.2.9

n2.3

n2.3-dev

n2.3.1

n2.3.2

n2.3.3

n2.3.4

n2.3.5

n2.3.6

n2.4

n2.4-dev

n2.4.1

n2.4.10

n2.4.11

n2.4.12

n2.4.13

n2.4.14

n2.4.2

n2.4.3

n2.4.4

n2.4.5

n2.4.6

n2.4.7

n2.4.8

n2.4.9

n2.5

n2.5-dev

n2.5.1

n2.5.10

n2.5.11

n2.5.2

n2.5.3

n2.5.4

n2.5.5

n2.5.6

n2.5.7

n2.5.8

n2.5.9

n2.6

n2.6-dev

n2.6.1

n2.6.2

n2.6.3

n2.6.4

n2.6.5

n2.6.6

n2.6.7

n2.6.8

n2.6.9

n2.7

n2.7-dev

n2.7.1

n2.7.2

n2.7.3

n2.7.4

n2.7.5

n2.7.6

n2.7.7

n2.8

n2.8-dev

n2.8.1

n2.8.10

n2.8.11

n2.8.12

n2.8.13

n2.8.14

n2.8.15

n2.8.16

n2.8.17

n2.8.18

n2.8.19

n2.8.2

n2.8.20

n2.8.21

n2.8.22

n2.8.3

n2.8.4

n2.8.5

n2.8.6

n2.8.7

n2.8.8

n2.8.9

n2.9-dev

n3.*

n3.0

n3.0.1

n3.0.10

n3.0.11

n3.0.12

n3.0.2

n3.0.3

n3.0.4

n3.0.5

n3.0.6

n3.0.7

n3.0.8

n3.0.9

n3.1

n3.1-dev

n3.1.1

n3.1.10

n3.1.11

n3.1.2

n3.1.3

n3.1.4

n3.1.5

n3.1.6

n3.1.7

n3.1.8

n3.1.9

n3.2

n3.2-dev

n3.2.1

n3.2.10

n3.2.11

n3.2.12

n3.2.13

n3.2.14

n3.2.15

n3.2.16

n3.2.17

n3.2.18

n3.2.19

n3.2.2

n3.2.3

n3.2.4

n3.2.5

n3.2.6

n3.2.7

n3.2.8

n3.2.9

n3.3

n3.3-dev

n3.3.1

n3.3.2

n3.3.3

n3.3.4

n3.3.5

n3.3.6

n3.3.7

n3.3.8

n3.3.9

n3.4

n3.4-dev

n3.4.1

n3.4.2

n3.4.3

n3.4.4

n3.4.5

n3.5-dev

n4.*

n4.0

n4.0.1

n4.0.2

n4.0.3

n4.0.4

n4.0.5

n4.0.6

n4.1

n4.1-dev

n4.1.1

n4.1.10

n4.1.11

n4.1.2

n4.1.3

n4.1.4

n4.1.5

n4.1.6

n4.1.7

n4.1.8

n4.1.9

n4.2-dev

v0.*

v0.5

v0.5.1

v0.5.2

v0.5.3

v0.6

v0.6.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11338.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "16.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "18.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "18.10"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "19.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "20.04"
            }
        ]
    }
]

vanir_signatures

[
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "45059981939637157877700820184160513142",
            "length": 3748.0
        },
        "source": "https://github.com/ffmpeg/ffmpeg/commit/9ccc633068c6fe76989f487c8932bd11886ad65b",
        "id": "CVE-2019-11338-27b24530",
        "target": {
            "file": "libavcodec/hevcdec.c",
            "function": "decode_nal_unit"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "167280379000740045495955150237615756625",
                "217014810008278832315784870144539884880",
                "275342592106358026505968957521723311896",
                "93282334362186985464861588891659759283",
                "20102417044240740358849022761902872871",
                "315077692536051889598880836078603069425",
                "70136499457010029194053811280640163862",
                "143535213550679828004584463617263301076",
                "128790428654206636083008055072316941250",
                "317589072920574188696555524382694908121",
                "230507251567370162258824489236627234082",
                "326752629143355640910394448450558654154",
                "272291046614698887552076985666997168650",
                "184162110970024235939528314086827681328",
                "138312105946242993354180976917596471857"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/ffmpeg/ffmpeg/commit/54655623a82632e7624714d7b2a3e039dc5faa7e",
        "id": "CVE-2019-11338-2ff1770d",
        "target": {
            "file": "libavcodec/hevcdec.c"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "331539604942389623747355164843225661104",
            "length": 14167.0
        },
        "source": "https://github.com/ffmpeg/ffmpeg/commit/9ccc633068c6fe76989f487c8932bd11886ad65b",
        "id": "CVE-2019-11338-50b395ac",
        "target": {
            "file": "libavcodec/hevcdec.c",
            "function": "hls_slice_header"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "267982237115177009869281056395071073673",
            "length": 5011.0
        },
        "source": "https://github.com/ffmpeg/ffmpeg/commit/54655623a82632e7624714d7b2a3e039dc5faa7e",
        "id": "CVE-2019-11338-57cefee5",
        "target": {
            "file": "libavcodec/hevcdec.c",
            "function": "decode_nal_unit"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "79026117247124224733924662327854734242",
            "length": 14204.0
        },
        "source": "https://github.com/ffmpeg/ffmpeg/commit/54655623a82632e7624714d7b2a3e039dc5faa7e",
        "id": "CVE-2019-11338-70732dfc",
        "target": {
            "file": "libavcodec/hevcdec.c",
            "function": "hls_slice_header"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "167280379000740045495955150237615756625",
                "217014810008278832315784870144539884880",
                "275342592106358026505968957521723311896",
                "93282334362186985464861588891659759283",
                "20102417044240740358849022761902872871",
                "247604245573560918611417214280701552476",
                "203456488689133841884968569597706019293",
                "226504480904387125210540704722477978516",
                "230507251567370162258824489236627234082",
                "326752629143355640910394448450558654154",
                "272291046614698887552076985666997168650",
                "184162110970024235939528314086827681328",
                "138312105946242993354180976917596471857"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/ffmpeg/ffmpeg/commit/9ccc633068c6fe76989f487c8932bd11886ad65b",
        "id": "CVE-2019-11338-f5c87da6",
        "target": {
            "file": "libavcodec/hevcdec.c"
        }
    }
]