{"id":"CVE-2018-15822","aliases":["DEBIAN-CVE-2018-15822","DLA-1809-1","DSA-4449-1","EUVD-2018-7680","GHSA-9cg9-6hp2-vf6p","MGASA-2019-0029","MGASA-2019-0223","SUSE-SU-2018:3609-1","UBUNTU-CVE-2018-15822","USN-3967-1","USN-4431-1","openSUSE-SU-2019:1066-1","openSUSE-SU-2024:10754-1"],"status":"published","title":"The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an...","description":"The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03266,"percentile":0.88478,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-617"],"published":"2018-08-23T00:00:00Z","modified":"2026-10-24T14:11:06Z","fixes":[{"ecosystem":"Debian:12","package":"ffmpeg","fixed_in":["7:4.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ffmpeg","fixed_in":["7:4.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:4.0.3-1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"mythtv","fixed_in":["30.0-20190121.1.mga6","30.0-20190121.1.mga6.tainted"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"mythtv-mythweb","fixed_in":["30.0-1.mga6"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"hdhomerun","fixed_in":["20180817-1.mga6"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"ffmpeg","fixed_in":["7:2.8.17-0ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"ffmpeg","fixed_in":["7:3.4.6-0ubuntu0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:11.12-1~deb8u7"}]}],"versions":["6:11.11-1~deb8u1","6:11.12-1~deb8u1","6:11.12-1~deb8u2","6:11.12-1~deb8u3","6:11.12-1~deb8u4","6:11.12-1~deb8u5","6:11.12-1~deb8u6","6:11.3-1","6:11.3-1+deb8u1","6:11.3-2","6:11.3-3","6:11.4-1","6:11.4-1~deb8u1","6:11.4-2","6:11.4-2+x32.1","6:11.6-1~deb8u1","6:11.7-1~deb8u1","6:11.8-1~deb8u1","6:11.9-1~deb8u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.2.14-1~deb9u1"}]}],"versions":["7:3.2.10-1~deb9u1","7:3.2.10-1~deb9u1~bpo8+1","7:3.2.11-1~deb9u1","7:3.2.12-1~deb9u1","7:3.2.5-1","7:3.2.6-1","7:3.2.7-1~deb9u1","7:3.2.8-1~deb9u1","7:3.2.9-1~deb9u1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:6","package":"live","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.11.26-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.9-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"mplayer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-13.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-2.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.9-1.mga6.tainted"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"mplayer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-13.mga6.tainted"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-2.mga6.tainted"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"mythtv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"30.0-20190121.1.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"mythtv-mythweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"30.0-1.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"hdhomerun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180817-1.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"mythtv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"30.0-20190121.1.mga6.tainted"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-4.12.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-4.12.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-4.12.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:2.8.17-0ubuntu0.1"}]}],"versions":["7:2.7.2-1build1","7:2.8.1-1ubuntu1","7:2.8.2-1ubuntu1","7:2.8.3-1","7:2.8.4-1","7:2.8.4-1ubuntu1","7:2.8.4-1ubuntu2","7:2.8.4-1ubuntu3","7:2.8.4-1ubuntu4","7:2.8.6-1ubuntu1","7:2.8.6-1ubuntu2","7:2.8.8-0ubuntu0.16.04.1","7:2.8.10-0ubuntu0.16.04.1","7:2.8.11-0ubuntu0.16.04.1","7:2.8.14-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.6-0ubuntu0.18.04.1"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.6-0ubuntu0.18.04.1"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:2.8.17-0ubuntu0.1"}]}],"versions":["7:2.7.2-1build1","7:2.8.1-1ubuntu1","7:2.8.2-1ubuntu1","7:2.8.3-1","7:2.8.4-1","7:2.8.4-1ubuntu1","7:2.8.4-1ubuntu2","7:2.8.4-1ubuntu3","7:2.8.4-1ubuntu4","7:2.8.6-1ubuntu1","7:2.8.6-1ubuntu2","7:2.8.8-0ubuntu0.16.04.1","7:2.8.10-0ubuntu0.16.04.1","7:2.8.11-0ubuntu0.16.04.1","7:2.8.14-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.8-0ubuntu0.2"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1","7:3.4.6-0ubuntu0.18.04.1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.2.4-1ubuntu0.1"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1"],"bundled":9},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-bp150.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4-5.2"}]}],"bundled":46}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"https://github.com/FFmpeg/FFmpeg/commit/6b67d7f05918f7a1ee8fc6ff21355d7e8736aa10","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://usn.ubuntu.com/3967-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://seclists.org/bugtraq/2019/May/60","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4449","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00043.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4431-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/FFmpeg/FFmpeg/commit/d8ecb335fe4852bbc172c7b79e66944d158b4d92","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-15822"},{"url":"https://github.com/advisories/GHSA-9cg9-6hp2-vf6p"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-15822","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0029.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24071","tags":["report"]},{"url":"http://live555.com/liveMedia/public/changelog.txt","tags":["web"]},{"url":"https://www.videolan.org/developers/vlc-branch/NEWS","tags":["web"]},{"url":"https://www.debian.org/security/2018/dsa-4343","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2019-0223.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24099","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24104","tags":["report"]},{"url":"https://www.mythtv.org/wiki/Release_Notes_-_29","tags":["web"]},{"url":"https://www.mythtv.org/wiki/Release_Notes_-_30","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183609-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1097983","tags":["report"]},{"url":"https://bugzilla.suse.com/1100345","tags":["report"]},{"url":"https://bugzilla.suse.com/1100348","tags":["report"]},{"url":"https://bugzilla.suse.com/1105869","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15822","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-15822","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3967-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4431-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-15822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9718","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11338","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12730","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13390","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-13904","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5JFIYYRNOGYLGMC55GONWEFOZJ5LAS7T/#5JFIYYRNOGYLGMC55GONWEFOZJ5LAS7T","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1092241","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14171","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-22046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38171","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-15822","description":"The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure.","status":"published","published":"2018-08-23T22:00:00Z","modified":"2024-08-05T10:01:54.691Z","updated_at":"2026-11-02T14:35:03.825765Z"}],"euvd":[{"id":"EUVD-2018-7680","description":"The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure.","status":"published","published":"2018-08-23T22:00:00Z","modified":"2024-08-05T10:01:54Z","updated_at":"2026-11-03T02:39:43.665553Z"}],"ghsa":[{"id":"GHSA-9cg9-6hp2-vf6p","title":"The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an...","description":"The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure.","status":"published","published":"2022-05-13T01:12:13Z","modified":"2023-01-28T05:04:59Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:44:17.062669Z"}],"nvd":[{"id":"CVE-2018-15822","description":"The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure.","status":"published","published":"2018-08-23T23:29:00.247Z","modified":"2026-06-17T01:43:09.94Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:04:36.842579Z"}],"osv":[{"id":"CVE-2018-15822","description":"The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure.","status":"published","published":"2018-08-23T23:29:00.247Z","modified":"2026-11-07T13:20:11.349431137Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"DEBIAN-CVE-2018-15822","description":"The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure.","status":"published","published":"2018-08-23T23:29:00.247Z","modified":"2026-10-23T18:03:55.568733599Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"UBUNTU-CVE-2018-15822","description":"The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure.","status":"published","published":"2018-08-23T00:00:00Z","modified":"2026-04-22T11:46:43.774708Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"DLA-1809-1","title":"libav - security update","status":"published","published":"2019-05-29T00:00:00Z","modified":"2026-03-09T01:19:56.717277Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4449-1","title":"ffmpeg - security update","status":"published","published":"2019-05-22T00:00:00Z","modified":"2026-03-09T02:10:42.770768Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0029","title":"Updated live, ffmpeg, mplayer, and vlc packages fix security vulnerabilities","description":"A bug in the server implementation of RTSP-over-HTTP in live could allow\na denial-of-service attack.\n\nA bug in the server implementation of RTSP-over-HTTP could allow a\nbuffer overflow, which could result in the execution of arbitrary code\nwhen parsing a malformed RTSP stream (CVE-2018-4013).\n\nThe flv_write_packet function in libavformat/flvenc.c in FFmpeg through\n3.3.8 does not check for an empty audio packet, leading to an assertion\nfailure (CVE-2018-15822).\n\nThe live package has been updated to version 2018.11.26, the ffmpeg\npackage has been updated to version 3.3.9, and the vlc package has been\nupdated to version 3.0.5, fixing these issues and other bugs.\n\nThe mplayer package has been rebuilt against the update live package to\nfix the RTSP-over-HTTP issues in mplayer.\n","status":"published","published":"2019-01-10T10:53:49Z","modified":"2026-04-16T06:23:17.341679028Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"MGASA-2019-0223","title":"Updated mythtv packages fix security issues","description":"This update provides and update to mythtv 30, and updates the bundled\nffmpeg to 3.2. It also fixes at least the following issue:\n\nThe flv_write_packet function in libavformat/flvenc.c in FFmpeg through\n 4.0.2 does not check for an empty audio packet, leading to an assertion\nfailure (CVE-2018-15822).  \n\nIt also fixes mythbackend missing needed environment variables (mga#24104).\n\nFor other changes/fixes in this update, see the referenced Release Notes.\n","status":"published","published":"2019-08-18T12:39:41Z","modified":"2026-04-16T04:44:47.208314165Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1066-1","title":"Security update for ffmpeg-4","description":"This update for ffmpeg-4 to version 4.0.2 fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2018-15822: The flv_write_packet function did not check for an empty\n  audio packet, leading to an assertion failure and DoS (bsc#1105869).\n- CVE-2018-13300: An improper argument passed to the avpriv_request_sample\n  function may have triggered an out-of-array read while converting a crafted AVI\n  file to MPEG4, leading to a denial of service and possibly an information\n  disclosure (bsc#1100348).\n\nThese non-security issues were fixed:\n\n- Enable webvtt encoders and decoders (boo#1092241).\n- Build codec2 encoder and decoder, add libcodec2 to\n  enable_decoders and enable_encoders.\n- Enable mpeg 1 and 2 encoders.\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-03-28T05:49:45Z","modified":"2026-02-04T03:28:07.589946Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10754-1","title":"ffmpeg-4-4.4-5.2 on GA media","description":"These are all security issues fixed in the ffmpeg-4-4.4-5.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:02:00.506105Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2018:3609-1","title":"Security update for ffmpeg","description":"This update for ffmpeg fixes the following issues:\n\n- CVE-2018-13300: An improper argument passed to the avpriv_request_sample\n  function may have triggered an out-of-array read while converting a crafted AVI\n  file to MPEG4, leading to a denial of service and possibly an information\n  disclosure (bsc#1100348)\n- CVE-2018-15822: The flv_write_packet function did not check for an empty\n  audio packet, leading to an assertion failure and DoS (bsc#1105869)\n- CVE-2018-13305: Due to a missing check for negative values of the mquant\n  variable, the vc1_put_blocks_clamped function in libavcodec/vc1_block.c\n  may trigger an out-of-array access while converting a crafted AVI\n  file to MPEG4, leading to an information disclosure or a denial of\n  service. (bsc#1100345).\n- CVE-2018-12458: An improper integer type in the mpeg4_encode_gop_header\n  function in libavcodec/mpeg4videoenc.c might have triggered an assertion\n  violation while converting a crafted AVI file to MPEG4, leading to a\n  denial of service. (bsc#1097983).\n","status":"published","published":"2018-11-02T16:11:02Z","modified":"2026-02-04T02:43:42.919036Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"USN-3967-1","title":"FFmpeg vulnerabilities","description":"It was discovered that FFmpeg contained multiple security issues when handling\ncertain multimedia files. If a user were tricked into opening a crafted\nmultimedia file, an attacker could cause a denial of service via application\ncrash.\n","status":"published","published":"2019-05-06T17:24:53Z","modified":"2026-04-22T09:56:06.140426Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4431-1","title":"ffmpeg vulnerabilities","description":"It was discovered that FFmpeg incorrectly verified empty audio packets or\nHEVC data. An attacker could possibly use this issue to cause a denial of\nservice via a crafted file. This issue only affected Ubuntu 16.04 LTS, as\nit was already fixed in Ubuntu 18.04 LTS. For more information see:\nhttps://usn.ubuntu.com/usn/usn-3967-1\n(CVE-2018-15822, CVE-2019-11338)\n\nIt was discovered that FFmpeg incorrectly handled sscanf failures. An\nattacker could possibly use this issue to cause a denial of service or\nother unspecified impact. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2019-12730)\n\nIt was discovered that FFmpeg incorrectly handled certain WEBM files. An\nattacker could possibly use this issue to obtain sensitive data or other\nunspecified impact. This issue only affected Ubuntu 20.04 LTS.\n(CVE-2019-13312)\n\nIt was discovered that FFmpeg incorrectly handled certain AVI files. An\nattacker could possibly use this issue to cause a denial of service or\nother unspecified impact. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2019-13390)\n\nIt was discovered that FFmpeg incorrectly handled certain input. An\nattacker could possibly use this issue to cause a denial of service or\nother unspecified impact. This issue only affected Ubuntu 18.04 LTS.\n(CVE-2019-17539)\n\nIt was discovered that FFmpeg incorrectly handled certain input during\ndecoding of VQA files. An attacker could possibly use this issue to\nobtain sensitive information or other unspecified impact. This issue\nonly affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-17542)\n\nIt was discovered that FFmpeg incorrectly handled certain JPEG files. An\nattacker could possibly use this issue to obtain sensitive information\nor other unspecified impact. This issue only affected Ubuntu 20.04 LTS.\n(CVE-2020-12284)\n\nIt was discovered that FFmpeg incorrectly handled certain M3U8 files. An\nattacker could possibly use this issue to obtain sensitive information\nor other unspecified impact. (CVE-2020-13904)\n","status":"published","published":"2020-07-22T16:18:53Z","modified":"2026-04-27T15:48:46.240203426Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}