CVE-2018-13301

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 4.0.1

Description The issue is related to the ff mpeg4 decode picture header function in the libavcodec/mpeg4videodec.c component of the FFmpeg multimedia library. It is caused by a missing check of a profile value before setting it, which may trigger a NULL pointer dereference when converting a specially crafted AVI file to MPEG4. This can lead to a denial of service. The vulnerability can be exploited by a remote attacker using a specially created AVI file.

Recommendations For FFmpeg version 4.0.1 and earlier, update to a version that includes the fix for the ff mpeg4 decode picture header function issue. As a temporary workaround, consider avoiding the use of the ff mpeg4 decode picture header function when converting AVI files to MPEG4 until a patch is available.