Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2019-1000016

Good to know:

icon
icon

Date: February 4, 2019

FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs_av1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in after commit b97a4b658814b2de8b9f2a3bce491c002d34de31.

Language: C

Severity Score

Related Resources (6)

https://nvd.nist.gov/vuln/detail/CVE-2019-1000016
https://github.com/FFmpeg/FFmpeg/commit/b97a4b658814b2de8b9f2a3bce491c002d34de31#diff-cd7e24986650014d67f484f3ffceef3f
https://people.canonical.com/~ubuntu-security/cve/CVE-2019-1000016
https://security-tracker.debian.org/tracker/CVE-2019-1000016
https://security.alpinelinux.org/vuln/CVE-2019-1000016
https://www.mend.io/vulnerability-database/CVE-2019-1000016

Severity Score

Weakness Type (CWE)

Improper Validation of Array Index

CWE-129

Top Fix

icon

Upgrade Version

Upgrade to version n4.1.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us