CVE-2019-12730

aareadheader in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables.

References

Affected packages

Git / git.ffmpeg.org/ffmpeg.git

Affected ranges

Type: GIT
Repo: https://git.ffmpeg.org/ffmpeg.git
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

9b4004c054964a49c7ba44583f4cee22486dd8f2

Fixed

n4.1.4

Type

GIT

Repo

https://github.com/ffmpeg/ffmpeg

Events

Introduced

Fixed

ba11e4028cfc5d40f49f26a44473a4f70d67c85d

Fixed

ed188f6dcdf0935c939ed813cf8745d50742014b

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.2.14"
        }
    ]
}

Affected versions

Other

ffmpeg-0.*

ffmpeg-0.6.3

n0.*

n0.10

n0.10.1

n0.10.10

n0.10.11

n0.10.12

n0.10.13

n0.10.14

n0.10.15

n0.10.16

n0.10.2

n0.10.3

n0.10.4

n0.10.5

n0.10.6

n0.10.7

n0.10.8

n0.10.9

n0.11

n0.11-dev

n0.11.1

n0.11.2

n0.11.3

n0.11.4

n0.11.5

n0.12-dev

n0.5.10

n0.5.11

n0.5.12

n0.5.13

n0.5.14

n0.5.15

n0.5.5

n0.5.6

n0.5.7

n0.5.8

n0.5.9

n0.6.4

n0.6.5

n0.6.6

n0.6.7

n0.7.1

n0.7.10

n0.7.11

n0.7.12

n0.7.13

n0.7.14

n0.7.15

n0.7.16

n0.7.17

n0.7.2

n0.7.3

n0.7.4

n0.7.5

n0.7.6

n0.7.7

n0.7.8

n0.7.9

n0.8

n0.8.1

n0.8.10

n0.8.11

n0.8.12

n0.8.13

n0.8.14

n0.8.15

n0.8.2

n0.8.3

n0.8.4

n0.8.5

n0.8.6

n0.8.7

n0.8.8

n0.8.9

n0.9

n0.9.1

n0.9.2

n0.9.3

n0.9.4

n1.*

n1.0

n1.0.1

n1.0.10

n1.0.2

n1.0.3

n1.0.4

n1.0.5

n1.0.6

n1.0.7

n1.0.8

n1.0.9

n1.1

n1.1-dev

n1.1.1

n1.1.10

n1.1.11

n1.1.12

n1.1.13

n1.1.14

n1.1.15

n1.1.16

n1.1.2

n1.1.3

n1.1.4

n1.1.5

n1.1.6

n1.1.7

n1.1.8

n1.1.9

n1.2

n1.2-dev

n1.2.1

n1.2.10

n1.2.11

n1.2.12

n1.2.2

n1.2.3

n1.2.4

n1.2.5

n1.2.6

n1.2.7

n1.2.8

n1.2.9

n1.3-dev

n2.*

n2.0

n2.0.1

n2.0.2

n2.0.3

n2.0.4

n2.0.5

n2.0.6

n2.0.7

n2.1

n2.1-dev

n2.1.1

n2.1.2

n2.1.3

n2.1.4

n2.1.5

n2.1.6

n2.1.7

n2.1.8

n2.2

n2.2-dev

n2.2-rc1

n2.2-rc2

n2.2.1

n2.2.10

n2.2.11

n2.2.12

n2.2.13

n2.2.14

n2.2.15

n2.2.16

n2.2.2

n2.2.3

n2.2.4

n2.2.5

n2.2.6

n2.2.7

n2.2.8

n2.2.9

n2.3

n2.3-dev

n2.3.1

n2.3.2

n2.3.3

n2.3.4

n2.3.5

n2.3.6

n2.4

n2.4-dev

n2.4.1

n2.4.10

n2.4.11

n2.4.12

n2.4.13

n2.4.14

n2.4.2

n2.4.3

n2.4.4

n2.4.5

n2.4.6

n2.4.7

n2.4.8

n2.4.9

n2.5

n2.5-dev

n2.5.1

n2.5.10

n2.5.11

n2.5.2

n2.5.3

n2.5.4

n2.5.5

n2.5.6

n2.5.7

n2.5.8

n2.5.9

n2.6

n2.6-dev

n2.6.1

n2.6.2

n2.6.3

n2.6.4

n2.6.5

n2.6.6

n2.6.7

n2.6.8

n2.6.9

n2.7

n2.7-dev

n2.7.1

n2.7.2

n2.7.3

n2.7.4

n2.7.5

n2.7.6

n2.7.7

n2.8

n2.8-dev

n2.8.1

n2.8.10

n2.8.11

n2.8.12

n2.8.13

n2.8.14

n2.8.15

n2.8.16

n2.8.17

n2.8.18

n2.8.19

n2.8.2

n2.8.20

n2.8.21

n2.8.22

n2.8.3

n2.8.4

n2.8.5

n2.8.6

n2.8.7

n2.8.8

n2.8.9

n2.9-dev

n3.*

n3.0

n3.0.1

n3.0.10

n3.0.11

n3.0.12

n3.0.2

n3.0.3

n3.0.4

n3.0.5

n3.0.6

n3.0.7

n3.0.8

n3.0.9

n3.1

n3.1-dev

n3.1.1

n3.1.10

n3.1.11

n3.1.2

n3.1.3

n3.1.4

n3.1.5

n3.1.6

n3.1.7

n3.1.8

n3.1.9

n3.2

n3.2-dev

n3.2.1

n3.2.10

n3.2.11

n3.2.12

n3.2.13

n3.2.14

n3.2.15

n3.2.16

n3.2.17

n3.2.18

n3.2.19

n3.2.2

n3.2.3

n3.2.4

n3.2.5

n3.2.6

n3.2.7

n3.2.8

n3.2.9

n3.3

n3.3-dev

n3.3.1

n3.3.2

n3.3.3

n3.3.4

n3.3.5

n3.3.6

n3.3.7

n3.3.8

n3.3.9

n3.4

n3.4-dev

n3.4.1

n3.4.10

n3.4.11

n3.4.12

n3.4.13

n3.4.14

n3.4.2

n3.4.3

n3.4.4

n3.4.5

n3.4.6

n3.4.7

n3.4.8

n3.4.9

n3.5-dev

n4.*

n4.0

n4.0.1

n4.0.2

n4.0.3

n4.0.4

n4.0.5

n4.0.6

n4.1

n4.1-dev

n4.1.1

n4.1.10

n4.1.11

n4.1.2

n4.1.3

n4.1.4

n4.1.5

n4.1.6

n4.1.7

n4.1.8

n4.1.9

n4.2

n4.2-dev

n4.2.1

n4.2.10

n4.2.11

n4.2.2

n4.2.3

n4.2.4

n4.2.5

n4.2.6

n4.2.7

n4.2.8

n4.2.9

n4.3

n4.3-dev

n4.3.1

n4.3.2

n4.3.3

n4.3.4

n4.3.5

n4.3.6

n4.3.7

n4.3.8

n4.3.9

n4.4

n4.4-dev

n4.4.1

n4.4.2

n4.4.3

n4.4.4

n4.4.5

n4.4.6

n4.5-dev

n5.*

n5.0

n5.0.1

n5.0.2

n5.0.3

n5.1

n5.1-dev

n5.1.1

n5.1.2

n5.1.3

n5.1.4

n5.1.5

n5.1.6

n5.1.7

n5.1.8

n5.2-dev

n6.*

n6.0

n6.0.1

n6.1

n6.1-dev

n6.1.1

n6.1.2

n6.1.3

n6.1.4

n6.2-dev

n7.*

n7.0

n7.0.1

n7.0.2

n7.0.3

n7.1

n7.1-dev

n7.1.1

n7.1.2

n7.1.3

n7.2-dev

n8.*

n8.0

n8.0.1

n8.1

n8.1-dev

n8.2-dev

v0.*

v0.5

v0.5.1

v0.5.2

v0.5.3

v0.6

v0.6.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12730.json"

vanir_signatures

[
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "305169126962415473109063619773134354271",
            "length": 5010.0
        },
        "source": "https://github.com/ffmpeg/ffmpeg/commit/ed188f6dcdf0935c939ed813cf8745d50742014b",
        "id": "CVE-2019-12730-7ad01a8b",
        "target": {
            "file": "libavformat/aadec.c",
            "function": "aa_read_header"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "230500099609806479454228911954939380534",
                "55508316595384027820348845657613488910",
                "136035362049246924189988944707562497944",
                "186174122281508782842403234461208723560",
                "326608014915734517485433510337139725250",
                "194489080888257855335467963784983309771",
                "338138698210939380158150647791524521621",
                "287571495035033928328411216777340090608",
                "291559305924628784409449412815549265630"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/ffmpeg/ffmpeg/commit/ed188f6dcdf0935c939ed813cf8745d50742014b",
        "id": "CVE-2019-12730-e5625f16",
        "target": {
            "file": "libavformat/aadec.c"
        }
    }
]