critical
CVE-2019-12730
aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x ...
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Ubuntu (medium).
Description
aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.10 | ffmpeg | 4.1.4-r0 |
| alpine 3.11 | ffmpeg | 4.1.4-r0 |
| alpine 3.12 | ffmpeg | 4.1.4-r0 |
| alpine 3.13 | ffmpeg | 4.1.4-r0 |
| alpine 3.14 | ffmpeg | 4.1.4-r0 |
| alpine 3.15 | ffmpeg | 4.1.4-r0 |
| alpine 3.16 | ffmpeg, ffmpeg4 | 4.1.4-r0 |
| alpine 3.17 | ffmpeg, ffmpeg4 | 4.1.4-r0 |
| alpine 3.18 | ffmpeg, ffmpeg4 | 4.1.4-r0 |
| alpine 3.19 | ffmpeg, ffmpeg4 | 4.1.4-r0 |
| alpine 3.20 | ffmpeg, ffmpeg4 | 4.1.4-r0 |
| alpine 3.21 | ffmpeg, ffmpeg4 | 4.1.4-r0 |
Show all 42 entries from 35 sources
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.10 | ffmpeg | 4.1.4-r0 |
| alpine 3.11 | ffmpeg | 4.1.4-r0 |
| alpine 3.12 | ffmpeg | 4.1.4-r0 |
| alpine 3.13 | ffmpeg | 4.1.4-r0 |
| alpine 3.14 | ffmpeg | 4.1.4-r0 |
| alpine 3.15 | ffmpeg | 4.1.4-r0 |
| alpine 3.16 | ffmpeg | 4.1.4-r0 |
| alpine 3.16 | ffmpeg4 | 4.1.4-r0 |
| alpine 3.17 | ffmpeg | 4.1.4-r0 |
| alpine 3.17 | ffmpeg4 | 4.1.4-r0 |
| alpine 3.18 | ffmpeg | 4.1.4-r0 |
| alpine 3.18 | ffmpeg4 | 4.1.4-r0 |
| alpine 3.19 | ffmpeg | 4.1.4-r0 |
| alpine 3.19 | ffmpeg4 | 4.1.4-r0 |
| alpine 3.20 | ffmpeg | 4.1.4-r0 |
| alpine 3.20 | ffmpeg4 | 4.1.4-r0 |
| alpine 3.21 | ffmpeg | 4.1.4-r0 |
| alpine 3.21 | ffmpeg4 | 4.1.4-r0 |
| alpine 3.22 | ffmpeg | 4.1.4-r0 |
| alpine 3.22 | ffmpeg4 | 4.1.4-r0 |
| alpine 3.23 | ffmpeg | 4.1.4-r0 |
| alpine 3.24 | ffmpeg | 4.1.4-r0 |
| alpine 3.9 | ffmpeg | 4.0.6-r0 |
| alpine edge | ffmpeg | 4.1.4-r0 |
| debian 10 | ffmpeg | 7:4.1.4-1~deb10u1 |
| debian 11 | ffmpeg | 7:4.1.4-1 |
| debian 12 | ffmpeg | 7:4.1.4-1 |
| debian 13 | ffmpeg | 7:4.1.4-1 |
| debian 14 | ffmpeg | 7:4.1.4-1 |
| debian 9 | ffmpeg | 7:3.2.14-1~deb9u1 |
| echo | ffmpeg | 7:4.1.4-1 |
| rapidfort alpine 3.20 | ffmpeg | 8.0.1-r1 |
| rapidfort alpine 3.21 | ffmpeg | 8.0.1-r1 |
| rapidfort alpine 3.22 | ffmpeg | 8.0.1-r1 |
| rapidfort alpine 3.23 | ffmpeg | 8.0.1-r1 |
| rapidfort alpine 3.24 | ffmpeg | 8.0.1-r1 |
| root.io debian 11 | rootio-ffmpeg | 7:4.1.4-1 |
| root.io debian 12 | rootio-ffmpeg | 7:4.1.4-1 |
| ubuntu 16.04 | ffmpeg | 7:2.8.17-0ubuntu0.1 |
| ubuntu 16.04-ESM | ffmpeg | 7:2.8.17-0ubuntu0.1 |
| ubuntu 18.04 | ffmpeg | 7:3.4.8-0ubuntu0.2 |
| ubuntu 18.04-ESM | ffmpeg | 7:3.4.8-0ubuntu0.2 |
References
- http://www.securityfocus.com/bid/109317
- https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/9b4004c054964a49c7ba44583f4cee22486dd8f2
- https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n4.1.4
- https://github.com/FFmpeg/FFmpeg/commit/ed188f6dcdf0935c939ed813cf8745d50742014b
- https://github.com/FFmpeg/FFmpeg/compare/a97ea53...ba11e40
- https://seclists.org/bugtraq/2019/Aug/30
- https://security.gentoo.org/glsa/202003-65
- https://ubuntu.com/security/notices/USN-4431-1