CVE-2018-6392

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The filter_slice function in libavfilter/vf_transpose.c in FFmpeg through 3.4.1 allows remote attackers to cause a denial of service (out-of-array access) via a crafted MP4 file.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/102848Third Party Advisory, VDB Entry
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/3f621455d62e46745453568d915badd5b1e5bcd5Issue Tracking, Patch, Vendor Advisory
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c6939f65a116b1ffed345d29d8621ee4ffb32235Issue Tracking, Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00041.html
https://www.debian.org/security/2018/dsa-4249Third Party Advisory
http://www.securityfocus.com/bid/102848Third Party Advisory, VDB Entry
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/3f621455d62e46745453568d915badd5b1e5bcd5Issue Tracking, Patch, Vendor Advisory
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c6939f65a116b1ffed345d29d8621ee4ffb32235Issue Tracking, Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00041.html
https://www.debian.org/security/2018/dsa-4249Third Party Advisory

Timeline

Published: Jan 29, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-63937.2FreePBX 10.13.66-32bit and 14.0.1.24 (SNG7-PBX-64bit-1712-2) allow post-authentication SQL injection via the order parameter. NOTE: the vend CVE-2018-63949.8SQL Injection exists in the InviteX 3.0.5 component for Joomla! via the invite_type parameter in a view=invites action.CVE-2018-63959.8SQL Injection exists in the Visual Calendar 3.1.3 component for Joomla! via the id parameter in a view=load action.CVE-2018-63969.8SQL Injection exists in the Google Map Landkarten through 4.2.3 component for Joomla! via the cid or id parameter in a layout=form_markers a CVE-2018-63977.5Directory Traversal exists in the Picture Calendar 3.1.4 component for Joomla! via the list.php folder parameter.CVE-2018-63989.8SQL Injection exists in the CP Event Calendar 3.0.1 component for Joomla! via the id parameter in a task=load action.CVE-2018-64007.8Kingsoft WPS Office Free 10.2.0.5978 allows local users to gain privileges or cause a denial of service by impersonating all the pipes throu CVE-2018-64019.8Meross MSS110 devices before 1.1.24 contain a TELNET listener providing access for an undocumented admin account with a blank password.CVE-2018-64027.5Ecobee Ecobee4 4.2.0.171 devices can be forced to deauthenticate and connect to an unencrypted Wi-Fi network with the same SSID, even if the CVE-2018-64056.5In the ReadDCMImage function in coders/dcm.c in ImageMagick before 7.0.7-23, each redmap, greenmap, and bluemap variable can be overwritten CVE-2018-64068.8The function ParseVP9SuperFrameIndex in common/libwebm_util.cc in libwebm through 2018-01-30 does not validate the child_frame_length data o CVE-2018-64077.5An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices. An unauthenticated attacker can crash a device by sending a POST