{"id":"CVE-2018-1999012","aliases":["ALPINE-CVE-2018-1999012","DEBIAN-CVE-2018-1999012","DLA-1740-1","DSA-4249-1","EUVD-2018-10707","GHSA-pvhq-7xgc-xmjm","SUSE-SU-2018:2305-1","UBUNTU-CVE-2018-1999012"],"status":"published","title":"FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop...","description":"FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02129,"percentile":0.82085,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2018-07-17T00:00:00Z","modified":"2026-11-03T06:31:20Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"ffmpeg4","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"ffmpeg4","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"ffmpeg4","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"ffmpeg4","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"ffmpeg4","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"ffmpeg4","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"ffmpeg4","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ffmpeg","fixed_in":["7:4.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ffmpeg","fixed_in":["7:4.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:4.0.2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"ffmpeg","fixed_in":["7:2.8.15-0ubuntu0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"ffmpeg4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"ffmpeg4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"ffmpeg4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"ffmpeg4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"ffmpeg4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"ffmpeg4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"ffmpeg4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:11.12-1~deb8u6"}]}],"versions":["6:11.11-1~deb8u1","6:11.12-1~deb8u1","6:11.12-1~deb8u2","6:11.12-1~deb8u3","6:11.12-1~deb8u4","6:11.12-1~deb8u5","6:11.3-1","6:11.3-1+deb8u1","6:11.3-2","6:11.3-3","6:11.4-1","6:11.4-1~deb8u1","6:11.4-2","6:11.4-2+x32.1","6:11.6-1~deb8u1","6:11.7-1~deb8u1","6:11.8-1~deb8u1","6:11.9-1~deb8u1"],"bundled":5},{"source":"osv","ecosystem":"Debian:9","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.2.11-1~deb9u1"}]}],"versions":["7:3.2.10-1~deb9u1","7:3.2.10-1~deb9u1~bpo8+1","7:3.2.5-1","7:3.2.6-1","7:3.2.7-1~deb9u1","7:3.2.8-1~deb9u1","7:3.2.9-1~deb9u1"],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6:0.8.7-1ubuntu2","6:9.10-1ubuntu1","6:9.10-1ubuntu2","6:9.10-1ubuntu5","6:9.10-1ubuntu6","6:9.10-1ubuntu7","6:9.11-2ubuntu1","6:9.11-2ubuntu2","6:9.13-0ubuntu0.14.04.1","6:9.14-0ubuntu0.14.04.1","6:9.16-0ubuntu0.14.04.1","6:9.18-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:2.8.15-0ubuntu0.16.04.1"}]}],"versions":["7:2.7.2-1build1","7:2.8.1-1ubuntu1","7:2.8.2-1ubuntu1","7:2.8.3-1","7:2.8.4-1","7:2.8.4-1ubuntu1","7:2.8.4-1ubuntu2","7:2.8.4-1ubuntu3","7:2.8.4-1ubuntu4","7:2.8.6-1ubuntu1","7:2.8.6-1ubuntu2","7:2.8.8-0ubuntu0.16.04.1","7:2.8.10-0ubuntu0.16.04.1","7:2.8.11-0ubuntu0.16.04.1","7:2.8.14-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"oxide-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.5-0ubuntu1","1.10.3-0ubuntu0.15.10.1","1.10.3-0ubuntu0.15.10.2","1.11.3-0ubuntu3","1.11.4-0ubuntu1","1.11.5-0ubuntu1","1.12.5-0ubuntu1","1.12.6-0ubuntu1","1.12.7-0ubuntu1","1.13.6-0ubuntu1","1.14.7-0ubuntu1","1.14.9-0ubuntu0.16.04.1","1.15.7-0ubuntu0.16.04.1","1.15.8-0ubuntu0.16.04.1","1.16.5-0ubuntu0.16.04.1","1.17.7-0ubuntu0.16.04.1","1.17.9-0ubuntu0.16.04.1","1.18.3-0ubuntu0.16.04.1","1.18.5-0ubuntu0.16.04.1","1.19.4-0ubuntu0.16.04.1","1.20.4-0ubuntu0.16.04.1","1.21.5-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gst-libav1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1","1.6.0-2","1.6.1-1","1.6.2-1","1.7.1-1","1.7.2-1","1.7.90-1","1.8.0-1","1.8.1-1~ubuntu1","1.8.2-1~ubuntu1","1.8.3-1ubuntu0.1","1.8.3-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"kino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.4-2.1build2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gst-libav1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.2-1","1.12.3-1","1.12.4-1","1.13.91-1","1.14.0-1","1.14.1-1~ubuntu18.04.1","1.14.4-0ubuntu1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"kino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.4-2.3","1.3.4-2.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.1+dfsg-4","5.9.1+dfsg-4ubuntu1","5.9.2+dfsg-2ubuntu1","5.9.3+dfsg-0ubuntu1","5.9.4+dfsg-0ubuntu1","5.9.5+dfsg-0ubuntu2","5.9.5+dfsg-0ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gst-libav1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.1-1","1.16.2-1","1.16.2-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"kino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.4+dfsg0-1","1.3.4+dfsg0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.12.4+dfsg-1ubuntu1","5.12.4+dfsg-1ubuntu3","5.12.5+dfsg-3ubuntu1","5.12.5+dfsg-6ubuntu2","5.12.5+dfsg-7","5.12.5+dfsg-7build1","5.12.8+dfsg-0ubuntu1","5.12.8+dfsg-0ubuntu1.1","5.12.8+dfsg-0ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:85.0.4183.83-0ubuntu2","1:85.0.4183.83-0ubuntu2.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gst-libav1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.5-1","1.20.0-1","1.20.1-1","1.20.3-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"kino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.4+dfsg0-1build2","1.3.4+dfsg0-1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.6+dfsg-1","5.15.6+dfsg-2","5.15.7+dfsg-2","5.15.8+dfsg-1","5.15.8+dfsg-1build1","5.15.8+dfsg-1build2","5.15.8+dfsg-2","5.15.9+dfsg-1","5.15.9+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:85.0.4183.83-0ubuntu3","2:1snap1-0ubuntu1","2:1snap1-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gst-libav1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.5-1","1.22.6-1","1.22.7-1","1.22.8-1","1.22.10-1","1.24.1-1","1.24.1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15+dfsg-2","5.15.15+dfsg-2build2","5.15.15+dfsg-2ubuntu1","5.15.16+dfsg-1","5.15.16+dfsg-1ubuntu2","5.15.16+dfsg-1ubuntu4","5.15.16+dfsg-3","5.15.16+dfsg-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gst-libav1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-1","1.26.1-1","1.26.2-1","1.26.3-1","1.26.4-1","1.26.5-1","1.26.6-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.18+dfsg-2","5.15.18+dfsg-2build1","5.15.19+dfsg-1","5.15.19+dfsg2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gst-libav1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.28.2-1","1.28.3-1","1.28.4-1build1","1.28.5-1","1.28.6-1","1.28.7-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.19+dfsg2-4","5.15.19+dfsg2-6","5.15.19+dfsg2-7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu3","2:1snap1-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gst-libav1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.6-1","1.27.2-1","1.27.2-1build1","1.27.90-1","1.28.0-1","1.28.1-1","1.28.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.19+dfsg2-1","5.15.19+dfsg2-1build1","5.15.19+dfsg2-2","5.15.19+dfsg2-3","5.15.19+dfsg2-4","5.15.19+dfsg2-4ubuntu0.1~esm1"]}],"products":[{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"http://www.securityfocus.com/bid/104896","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/FFmpeg/FFmpeg/commit/9807d3976be0e92e4ece3b4b1701be894cd7c2e1","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00041.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1999012"},{"url":"https://github.com/advisories/GHSA-pvhq-7xgc-xmjm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-1999012","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1999012","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182305-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1100356","tags":["report"]},{"url":"https://bugzilla.suse.com/1102687","tags":["report"]},{"url":"https://bugzilla.suse.com/1102688","tags":["report"]},{"url":"https://bugzilla.suse.com/1102689","tags":["report"]},{"url":"https://bugzilla.suse.com/1102899","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1999010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1999011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1999012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1999013","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-1999012","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1999012","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-1999012","description":"FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later.","status":"published","published":"2018-07-23T15:00:00Z","modified":"2024-08-05T12:47:57.58Z","updated_at":"2026-11-02T14:35:07.354449Z"}],"euvd":[{"id":"EUVD-2018-10707","description":"FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later.","status":"published","published":"2018-07-23T15:00:00Z","modified":"2024-08-05T12:47:57Z","updated_at":"2026-11-03T02:39:25.8334Z"}],"ghsa":[{"id":"GHSA-pvhq-7xgc-xmjm","title":"FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop...","description":"FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later.","status":"published","published":"2022-05-13T01:50:55Z","modified":"2023-02-02T05:02:02Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:51:20.253646Z"}],"nvd":[{"id":"CVE-2018-1999012","description":"FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later.","status":"published","published":"2018-07-23T15:29:00.393Z","modified":"2026-06-17T01:48:16.507Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":7.1,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:04:33.865124Z"}],"osv":[{"id":"ALPINE-CVE-2018-1999012","description":"FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later.","status":"published","published":"2018-07-23T15:29:00.393Z","modified":"2026-11-03T06:31:20.799470815Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:18:23.800469Z"},{"id":"CVE-2018-1999012","description":"FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later.","status":"published","published":"2018-07-23T15:29:00.393Z","modified":"2026-11-07T13:20:03.00081244Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"DEBIAN-CVE-2018-1999012","description":"FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later.","status":"published","published":"2018-07-23T15:29:00.393Z","modified":"2026-10-23T18:03:56.512637968Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"UBUNTU-CVE-2018-1999012","description":"FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later.","status":"published","published":"2018-07-23T15:29:00Z","modified":"2026-10-17T12:55:23.762551387Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"DLA-1740-1","title":"libav - security update","status":"published","published":"2019-03-31T00:00:00Z","modified":"2026-03-09T01:18:06.175051Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4249-1","title":"ffmpeg - security update","status":"published","published":"2018-07-17T00:00:00Z","modified":"2026-03-09T02:10:18.818901Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"SUSE-SU-2018:2305-1","title":"Security update for ffmpeg","description":"This update for ffmpeg fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-13302: Fixed out of array access issue (bsc#1100356).\n- CVE-2018-1999010: Fixed multiple out of array access vulnerabilities in the\n  mms protocol that could result in accessing out of bound data via specially\n  crafted input files (bnc#1102899)\n- CVE-2018-1999011: Fixed a heap buffer overflow in asf_o format demuxer that\n  could result in remote code execution (bnc#1102689)\n- CVE-2018-1999012: Fixed an infinite loop vulnerability in pva format demuxer\n  that could result in excessive amount of ressource allocation like CPU an RAM\n  (CVE-2018-1999012 bnc#1102688).\n- CVE-2018-1999013: Fixed an use-after-free vulnerability in the realmedia\n  demuxer that could allow remote attackers to read heap memory (bnc#1102687)\n","status":"published","published":"2018-08-10T20:25:31Z","modified":"2026-02-04T02:25:09.25043Z","updated_at":"2026-11-02T15:53:44.972817Z"}]}}