CVE-2018-13304

Name of the Vulnerable Software and Affected Versions FFmpeg version 4.0.1

Description The issue is related to improper maintenance of consistency between the context profile field and studio profile in libavcodec, which may trigger an assertion failure when converting a crafted AVI file to MPEG4. This can lead to a denial of service. The affected components include error resilience.c, h263dec.c, and mpeg4videodec.c. A remote attacker can exploit this issue using a specially crafted AVI file.

Recommendations For FFmpeg version 4.0.1, consider disabling the affected components, such as error resilience.c, h263dec.c, and mpeg4videodec.c, as a temporary workaround to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.