{"id":"CVE-2018-1999013","aliases":["ALPINE-CVE-2018-1999013","DEBIAN-CVE-2018-1999013","DSA-4249-1","EUVD-2018-10708","GHSA-74ff-r9q5-73vp","SUSE-SU-2018:2305-1","UBUNTU-CVE-2018-1999013"],"status":"published","title":"FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free...","description":"FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01742,"percentile":0.77912,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2018-07-17T00:00:00Z","modified":"2026-11-03T06:31:27Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ffmpeg","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"ffmpeg4","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"ffmpeg4","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"ffmpeg4","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"ffmpeg4","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"ffmpeg4","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"ffmpeg4","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"ffmpeg4","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ffmpeg","fixed_in":["7:4.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ffmpeg","fixed_in":["7:4.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:4.0.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"ffmpeg4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"ffmpeg4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"ffmpeg4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"ffmpeg4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"ffmpeg4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"ffmpeg4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"ffmpeg4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.2.11-1~deb9u1"}]}],"versions":["7:3.2.10-1~deb9u1","7:3.2.10-1~deb9u1~bpo8+1","7:3.2.5-1","7:3.2.6-1","7:3.2.7-1~deb9u1","7:3.2.8-1~deb9u1","7:3.2.9-1~deb9u1"],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"oxide-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.5-0ubuntu1","1.10.3-0ubuntu0.15.10.1","1.10.3-0ubuntu0.15.10.2","1.11.3-0ubuntu3","1.11.4-0ubuntu1","1.11.5-0ubuntu1","1.12.5-0ubuntu1","1.12.6-0ubuntu1","1.12.7-0ubuntu1","1.13.6-0ubuntu1","1.14.7-0ubuntu1","1.14.9-0ubuntu0.16.04.1","1.15.7-0ubuntu0.16.04.1","1.15.8-0ubuntu0.16.04.1","1.16.5-0ubuntu0.16.04.1","1.17.7-0ubuntu0.16.04.1","1.17.9-0ubuntu0.16.04.1","1.18.3-0ubuntu0.16.04.1","1.18.5-0ubuntu0.16.04.1","1.19.4-0ubuntu0.16.04.1","1.20.4-0ubuntu0.16.04.1","1.21.5-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gst-libav1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1","1.6.0-2","1.6.1-1","1.6.2-1","1.7.1-1","1.7.2-1","1.7.90-1","1.8.0-1","1.8.1-1~ubuntu1","1.8.2-1~ubuntu1","1.8.3-1ubuntu0.1","1.8.3-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gst-libav1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.2-1","1.12.3-1","1.12.4-1","1.13.91-1","1.14.0-1","1.14.1-1~ubuntu18.04.1","1.14.4-0ubuntu1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.1+dfsg-4","5.9.1+dfsg-4ubuntu1","5.9.2+dfsg-2ubuntu1","5.9.3+dfsg-0ubuntu1","5.9.4+dfsg-0ubuntu1","5.9.5+dfsg-0ubuntu2","5.9.5+dfsg-0ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gst-libav1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.1-1","1.16.2-1","1.16.2-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.12.4+dfsg-1ubuntu1","5.12.4+dfsg-1ubuntu3","5.12.5+dfsg-3ubuntu1","5.12.5+dfsg-6ubuntu2","5.12.5+dfsg-7","5.12.5+dfsg-7build1","5.12.8+dfsg-0ubuntu1","5.12.8+dfsg-0ubuntu1.1","5.12.8+dfsg-0ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:85.0.4183.83-0ubuntu2","1:85.0.4183.83-0ubuntu2.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gst-libav1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.5-1","1.20.0-1","1.20.1-1","1.20.3-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.6+dfsg-1","5.15.6+dfsg-2","5.15.7+dfsg-2","5.15.8+dfsg-1","5.15.8+dfsg-1build1","5.15.8+dfsg-1build2","5.15.8+dfsg-2","5.15.9+dfsg-1","5.15.9+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:85.0.4183.83-0ubuntu3","2:1snap1-0ubuntu1","2:1snap1-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gst-libav1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.5-1","1.22.6-1","1.22.7-1","1.22.8-1","1.22.10-1","1.24.1-1","1.24.1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15+dfsg-2","5.15.15+dfsg-2build2","5.15.15+dfsg-2ubuntu1","5.15.16+dfsg-1","5.15.16+dfsg-1ubuntu2","5.15.16+dfsg-1ubuntu4","5.15.16+dfsg-3","5.15.16+dfsg-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gst-libav1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-1","1.26.1-1","1.26.2-1","1.26.3-1","1.26.4-1","1.26.5-1","1.26.6-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.18+dfsg-2","5.15.18+dfsg-2build1","5.15.19+dfsg-1","5.15.19+dfsg2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gst-libav1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.28.2-1","1.28.3-1","1.28.4-1build1","1.28.5-1","1.28.6-1","1.28.7-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.19+dfsg2-4","5.15.19+dfsg2-6","5.15.19+dfsg2-7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu3","2:1snap1-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gst-libav1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.6-1","1.27.2-1","1.27.2-1build1","1.27.90-1","1.28.0-1","1.28.1-1","1.28.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.19+dfsg2-1","5.15.19+dfsg2-1build1","5.15.19+dfsg2-2","5.15.19+dfsg2-3","5.15.19+dfsg2-4","5.15.19+dfsg2-4ubuntu0.1~esm1"]}],"products":[{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"http://www.securityfocus.com/bid/104896","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/FFmpeg/FFmpeg/commit/a7e032a277452366771951e29fd0bf2bd5c029f0","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1999013"},{"url":"https://github.com/advisories/GHSA-74ff-r9q5-73vp"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-1999013","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1999013","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182305-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1100356","tags":["report"]},{"url":"https://bugzilla.suse.com/1102687","tags":["report"]},{"url":"https://bugzilla.suse.com/1102688","tags":["report"]},{"url":"https://bugzilla.suse.com/1102689","tags":["report"]},{"url":"https://bugzilla.suse.com/1102899","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1999010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1999011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1999012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1999013","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-1999013","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1999013","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-1999013","description":"FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later.","status":"published","published":"2018-07-23T15:00:00Z","modified":"2024-08-05T12:47:57.49Z","updated_at":"2026-11-02T14:35:07.354449Z"}],"euvd":[{"id":"EUVD-2018-10708","description":"FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later.","status":"published","published":"2018-07-23T15:00:00Z","modified":"2024-08-05T12:47:57Z","updated_at":"2026-11-03T02:39:25.8334Z"}],"ghsa":[{"id":"GHSA-74ff-r9q5-73vp","title":"FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free...","description":"FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later.","status":"published","published":"2022-05-14T02:58:55Z","modified":"2023-02-02T05:07:00Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:52:24.832262Z"}],"nvd":[{"id":"CVE-2018-1999013","description":"FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later.","status":"published","published":"2018-07-23T15:29:00.423Z","modified":"2026-06-17T01:48:16.63Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:04:33.865124Z"}],"osv":[{"id":"ALPINE-CVE-2018-1999013","description":"FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later.","status":"published","published":"2018-07-23T15:29:00.423Z","modified":"2026-11-03T06:31:27.060448266Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:18:23.800469Z"},{"id":"CVE-2018-1999013","description":"FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later.","status":"published","published":"2018-07-23T15:29:00.423Z","modified":"2026-11-07T13:20:00.986527832Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"DEBIAN-CVE-2018-1999013","description":"FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later.","status":"published","published":"2018-07-23T15:29:00.423Z","modified":"2026-10-23T18:03:04.30213913Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"UBUNTU-CVE-2018-1999013","description":"FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later.","status":"published","published":"2018-07-23T15:29:00Z","modified":"2026-10-17T12:55:24.046626005Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"DSA-4249-1","title":"ffmpeg - security update","status":"published","published":"2018-07-17T00:00:00Z","modified":"2026-03-09T02:10:18.818901Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"SUSE-SU-2018:2305-1","title":"Security update for ffmpeg","description":"This update for ffmpeg fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-13302: Fixed out of array access issue (bsc#1100356).\n- CVE-2018-1999010: Fixed multiple out of array access vulnerabilities in the\n  mms protocol that could result in accessing out of bound data via specially\n  crafted input files (bnc#1102899)\n- CVE-2018-1999011: Fixed a heap buffer overflow in asf_o format demuxer that\n  could result in remote code execution (bnc#1102689)\n- CVE-2018-1999012: Fixed an infinite loop vulnerability in pva format demuxer\n  that could result in excessive amount of ressource allocation like CPU an RAM\n  (CVE-2018-1999012 bnc#1102688).\n- CVE-2018-1999013: Fixed an use-after-free vulnerability in the realmedia\n  demuxer that could allow remote attackers to read heap memory (bnc#1102687)\n","status":"published","published":"2018-08-10T20:25:31Z","modified":"2026-02-04T02:25:09.25043Z","updated_at":"2026-11-02T15:53:44.972817Z"}]}}