{"id":"CVE-2019-11338","aliases":["DEBIAN-CVE-2019-11338","DLA-1809-1","DSA-4449-1","EUVD-2019-3019","GHSA-96rf-5r43-949p","UBUNTU-CVE-2019-11338","USN-3967-1","USN-4431-1","openSUSE-SU-2020:0024-1","openSUSE-SU-2024:10754-1"],"status":"published","title":"libavcodec/hevcdec.c in FFmpeg 4.1.2 mishandles detection of duplicate first slices, which allows...","description":"libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02354,"percentile":0.83951,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2019-04-18T00:00:00Z","modified":"2026-10-24T14:20:21Z","fixes":[{"ecosystem":"Debian:12","package":"ffmpeg","fixed_in":["7:4.1.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ffmpeg","fixed_in":["7:4.1.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:4.1.3-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"ffmpeg","fixed_in":["7:2.8.17-0ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"ffmpeg","fixed_in":["7:3.4.6-0ubuntu0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.1.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.1.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.1.3-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:11.12-1~deb8u7"}]}],"versions":["6:11.11-1~deb8u1","6:11.12-1~deb8u1","6:11.12-1~deb8u2","6:11.12-1~deb8u3","6:11.12-1~deb8u4","6:11.12-1~deb8u5","6:11.12-1~deb8u6","6:11.3-1","6:11.3-1+deb8u1","6:11.3-2","6:11.3-3","6:11.4-1","6:11.4-1~deb8u1","6:11.4-2","6:11.4-2+x32.1","6:11.6-1~deb8u1","6:11.7-1~deb8u1","6:11.8-1~deb8u1","6:11.9-1~deb8u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.2.14-1~deb9u1"}]}],"versions":["7:3.2.10-1~deb9u1","7:3.2.10-1~deb9u1~bpo8+1","7:3.2.11-1~deb9u1","7:3.2.12-1~deb9u1","7:3.2.5-1","7:3.2.6-1","7:3.2.7-1~deb9u1","7:3.2.8-1~deb9u1","7:3.2.9-1~deb9u1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:2.8.17-0ubuntu0.1"}]}],"versions":["7:2.7.2-1build1","7:2.8.1-1ubuntu1","7:2.8.2-1ubuntu1","7:2.8.3-1","7:2.8.4-1","7:2.8.4-1ubuntu1","7:2.8.4-1ubuntu2","7:2.8.4-1ubuntu3","7:2.8.4-1ubuntu4","7:2.8.6-1ubuntu1","7:2.8.6-1ubuntu2","7:2.8.8-0ubuntu0.16.04.1","7:2.8.10-0ubuntu0.16.04.1","7:2.8.11-0ubuntu0.16.04.1","7:2.8.14-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.6-0ubuntu0.18.04.1"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.6-0ubuntu0.18.04.1"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:2.8.17-0ubuntu0.1"}]}],"versions":["7:2.7.2-1build1","7:2.8.1-1ubuntu1","7:2.8.2-1ubuntu1","7:2.8.3-1","7:2.8.4-1","7:2.8.4-1ubuntu1","7:2.8.4-1ubuntu2","7:2.8.4-1ubuntu3","7:2.8.4-1ubuntu4","7:2.8.6-1ubuntu1","7:2.8.6-1ubuntu2","7:2.8.8-0ubuntu0.16.04.1","7:2.8.10-0ubuntu0.16.04.1","7:2.8.11-0ubuntu0.16.04.1","7:2.8.14-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.8-0ubuntu0.2"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1","7:3.4.6-0ubuntu0.18.04.1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.2.4-1ubuntu0.1"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1"],"bundled":9},{"source":"osv","ecosystem":"SUSE:Package Hub 12 SP2","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-bp151.5.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-bp151.5.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-bp151.5.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-bp151.5.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4-5.2"}]}],"bundled":46}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"ffmpeg","product":"ffmpeg"},{"vendor":"novell","product":"suse_package_hub_for_suse_linux_enterprise"}],"references":[{"url":"https://github.com/FFmpeg/FFmpeg/commit/54655623a82632e7624714d7b2a3e039dc5faa7e","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"http://www.securityfocus.com/bid/108034","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","web"]},{"url":"https://usn.ubuntu.com/3967-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://seclists.org/bugtraq/2019/May/60","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4449","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00043.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00012.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4431-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/FFmpeg/FFmpeg/commit/9ccc633068c6fe76989f487c8932bd11886ad65b","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11338"},{"url":"https://github.com/advisories/GHSA-96rf-5r43-949p"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-11338","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-11338","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3967-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4431-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11338","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-15822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9718","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12730","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13390","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-13904","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BENAOQWJIO5XL2GAHMLNOYWYAO26XGQM/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1100345","tags":["report"]},{"url":"https://bugzilla.suse.com/1133123","tags":["report"]},{"url":"https://bugzilla.suse.com/1133153","tags":["report"]},{"url":"https://bugzilla.suse.com/1133155","tags":["report"]},{"url":"https://bugzilla.suse.com/1149839","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15942","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14171","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-22046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38171","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-11338","description":"libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.","status":"published","published":"2019-04-18T23:52:00Z","modified":"2024-08-04T22:48:09.222Z","updated_at":"2026-11-02T14:20:26.416173Z"}],"euvd":[{"id":"EUVD-2019-3019","description":"libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.","status":"published","published":"2019-04-18T23:52:00Z","modified":"2024-08-04T22:48:09Z","updated_at":"2026-11-03T02:40:49.794129Z"}],"ghsa":[{"id":"GHSA-96rf-5r43-949p","title":"libavcodec/hevcdec.c in FFmpeg 4.1.2 mishandles detection of duplicate first slices, which allows...","description":"libavcodec/hevcdec.c in FFmpeg 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.","status":"published","published":"2022-05-24T16:43:56Z","modified":"2023-01-28T05:04:59Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:44:17.062669Z"}],"nvd":[{"id":"CVE-2019-11338","description":"libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.","status":"published","published":"2019-04-19T00:29:00.23Z","modified":"2026-06-17T02:12:44.133Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:05:11.426883Z"}],"osv":[{"id":"CVE-2019-11338","description":"libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.","status":"published","published":"2019-04-19T00:29:00.23Z","modified":"2026-11-07T13:20:05.795644874Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"DEBIAN-CVE-2019-11338","description":"libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.","status":"published","published":"2019-04-19T00:29:00.23Z","modified":"2026-09-21T07:01:59.461595374Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"UBUNTU-CVE-2019-11338","description":"libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.","status":"published","published":"2019-04-18T00:00:00Z","modified":"2026-04-22T12:06:49.289473Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"DLA-1809-1","title":"libav - security update","status":"published","published":"2019-05-29T00:00:00Z","modified":"2026-03-09T01:19:56.717277Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4449-1","title":"ffmpeg - security update","status":"published","published":"2019-05-22T00:00:00Z","modified":"2026-03-09T02:10:42.770768Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"openSUSE-SU-2020:0024-1","title":"Security update for ffmpeg-4","description":"This update for ffmpeg-4 fixes the following issues:\n\nffmpeg-4 was updated to version 4.0.5, fixes boo#1133153 \n\n- CVE-2019-11339: The studio profile decoder in libavcodec/mpeg4videodec.c\n  in FFmpeg 4.0 allowed remote attackers to cause a denial of service\n  (out-of-array access) or possibly have unspecified. (bsc#1133153)\n- For other changes see /usr/share/doc/packages/libavcodec58/Changelog\n\nUpdate to version 4.2.1:\n\n* Stable bug fix release, mainly codecs and format fixes.\n\n- CVE-2019-15942: Conditional jump or move depends on uninitialised value' issue in h2645_parse (boo#1149839)\n\nUpdate to FFmpeg 4.2 'Ada'\n\n* tpad filter\n* AV1 decoding support through libdav1d\n* dedot filter\n* chromashift and rgbashift filters\n* freezedetect filter\n* truehd_core bitstream filter\n* dhav demuxer\n* PCM-DVD encoder\n* GIF parser\n* vividas demuxer\n* hymt decoder\n* anlmdn filter\n* maskfun filter\n* hcom demuxer and decoder\n* ARBC decoder\n* libaribb24 based ARIB STD-B24 caption support (profiles A and C)\n* Support decoding of HEVC 4:4:4 content in nvdec and cuviddec\n* removed libndi-newtek\n* agm decoder\n* KUX demuxer\n* AV1 frame split bitstream filter\n* lscr decoder\n* lagfun filter\n* asoftclip filter\n* Support decoding of HEVC 4:4:4 content in vdpau\n* colorhold filter\n* xmedian filter\n* asr filter\n* showspatial multimedia filter\n* VP4 video decoder\n* IFV demuxer\n* derain filter\n* deesser filter\n* mov muxer writes tracks with unspecified language instead of English by default\n* added support for using clang to compile CUDA kernels\n\n- See /usr/share/doc/packages/ffmpeg-4/Changelog for the complete changelog.\n\nUpdate to version 4.1.4\n\n* See /usr/share/doc/packages/ffmpeg-4/Changelog for the complete changelog.\n\n- Enable runtime enabling for fdkaac via --enable-libfdk-aac-dlopen\n\nUpdate to version 4.1.3:\n\n* Updates and bug fixes for codecs, filters and formats.\n  [boo#1133153, boo#1133155, CVE-2019-11338, CVE-2019-11339]\n\nUpdate to version 4.1.2:\n\n* Updates and bug fixes for codecs, filters and formats.\n\nUpdate to version 4.1.1:\n\n* Various filter and codec fixes and enhancements.\n* configure: Add missing xlib dependency for VAAPI X11 code.\n* For complete changelog, see /usr/share/doc/packages/ffmpeg-4/Changelog\n* enable AV1 support on x86_64\n\nUpdate ffmpeg to 4.1:\n\n* Lots of filter updates as usual: deblock, tmix, aplify,\n  fftdnoiz, aderivative, aintegral, pal75bars, pal100bars,\n  adeclick, adeclip, lensfun (wrapper), colorconstancy, 1D LUT\n  filter (lut1d), cue, acue, transpose_npp, amultiply,\n  Block-Matching 3d (bm3d) denoising filter, acrossover filter,\n  audio denoiser as afftdn filter, sinc audio filter source,\n  chromahold, setparams, vibrance, xstack,\n  (a)graphmonitor filter yadif_cuda filter.\n* AV1 parser\n* Support for AV1 in MP4\n* PCM VIDC decoder and encoder\n* libtensorflow backend for DNN based filters like srcnn\n* -- The following only enabled in third-party builds:\n* ATRAC9 decoder\n* AVS2 video decoder via libdavs2\n* IMM4 video decoder\n* Brooktree ProSumer video decoder\n* MatchWare Screen Capture Codec decoder\n* WinCam Motion Video decoder\n* RemotelyAnywhere Screen Capture decoder\n* AVS2 video encoder via libxavs2\n* ILBC decoder\n* SER demuxer\n* Decoding S12M timecode in H264\n* For complete changelog, see https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n4.1\n\nUpdate ffmpeg to 4.0.3:\n\n* For complete changelog, see https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n4.0.3\n\n- CVE-2018-13305: Added a missing check for negative values of mqaunt variable (boo#1100345).\n\n","status":"published","published":"2020-01-13T15:18:52Z","modified":"2026-02-04T04:36:02.914243Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10754-1","title":"ffmpeg-4-4.4-5.2 on GA media","description":"These are all security issues fixed in the ffmpeg-4-4.4-5.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:02:00.506105Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-3967-1","title":"FFmpeg vulnerabilities","description":"It was discovered that FFmpeg contained multiple security issues when handling\ncertain multimedia files. If a user were tricked into opening a crafted\nmultimedia file, an attacker could cause a denial of service via application\ncrash.\n","status":"published","published":"2019-05-06T17:24:53Z","modified":"2026-04-22T09:56:06.140426Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4431-1","title":"ffmpeg vulnerabilities","description":"It was discovered that FFmpeg incorrectly verified empty audio packets or\nHEVC data. An attacker could possibly use this issue to cause a denial of\nservice via a crafted file. This issue only affected Ubuntu 16.04 LTS, as\nit was already fixed in Ubuntu 18.04 LTS. For more information see:\nhttps://usn.ubuntu.com/usn/usn-3967-1\n(CVE-2018-15822, CVE-2019-11338)\n\nIt was discovered that FFmpeg incorrectly handled sscanf failures. An\nattacker could possibly use this issue to cause a denial of service or\nother unspecified impact. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2019-12730)\n\nIt was discovered that FFmpeg incorrectly handled certain WEBM files. An\nattacker could possibly use this issue to obtain sensitive data or other\nunspecified impact. This issue only affected Ubuntu 20.04 LTS.\n(CVE-2019-13312)\n\nIt was discovered that FFmpeg incorrectly handled certain AVI files. An\nattacker could possibly use this issue to cause a denial of service or\nother unspecified impact. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2019-13390)\n\nIt was discovered that FFmpeg incorrectly handled certain input. An\nattacker could possibly use this issue to cause a denial of service or\nother unspecified impact. This issue only affected Ubuntu 18.04 LTS.\n(CVE-2019-17539)\n\nIt was discovered that FFmpeg incorrectly handled certain input during\ndecoding of VQA files. An attacker could possibly use this issue to\nobtain sensitive information or other unspecified impact. This issue\nonly affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-17542)\n\nIt was discovered that FFmpeg incorrectly handled certain JPEG files. An\nattacker could possibly use this issue to obtain sensitive information\nor other unspecified impact. This issue only affected Ubuntu 20.04 LTS.\n(CVE-2020-12284)\n\nIt was discovered that FFmpeg incorrectly handled certain M3U8 files. An\nattacker could possibly use this issue to obtain sensitive information\nor other unspecified impact. (CVE-2020-13904)\n","status":"published","published":"2020-07-22T16:18:53Z","modified":"2026-04-27T15:48:46.240203426Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}