CVE-2018-12459

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An inconsistent bits-per-sample value in the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c in FFmpeg 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4, leading to a denial of service.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jun 15, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-12466.1Dell EMC Unity and UnityVSA contains reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially explo CVE-2018-124606.5libavcodec in FFmpeg 4.0 may trigger a NULL pointer dereference if the studio profile is incorrectly detected while converting a crafted AVI CVE-2018-124617.5Fixed issues with NetIQ eDirectory prior to 9.1.1 when checking certificate revocation.CVE-2018-124626.1NetIQ iManager 3.1.1 addresses potential XSS vulnerabilities.CVE-2018-124639.8An XML external entity (XXE) vulnerability in Fortify Software Security Center (SSC), version 17.1, 17.2, 18.1 allows remote unauthenticated CVE-2018-124649.8A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthen CVE-2018-124657.2An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote atta CVE-2018-124666.5openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.CVE-2018-124676.5Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:Ini CVE-2018-124687.2A vulnerability in the administration console of Micro Focus GroupWise prior to version 18.0.2 may allow a remote attacker authenticated as CVE-2018-124697.5Incorrect handling of an invalid value for an HTTP request parameter by Directory Server (aka Enterprise Server Administration web UI) in Mi CVE-2018-12477.1RSA Authentication Manager Security Console, version 8.3 and earlier, contains a XML External Entity (XXE) vulnerability. This could potenti