CVE-2019-17539: Null Pointer Dereference
First published: Mon Oct 14 2019(Updated: )
In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| FFmpeg FFmpeg | <3.4.7 | |
| FFmpeg FFmpeg | >=4.0<4.0.5 | |
| FFmpeg FFmpeg | >=4.1<4.1.5 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| Canonical Ubuntu Linux | =16.04 | |
| Canonical Ubuntu Linux | =18.04 | |
| Canonical Ubuntu Linux | =20.04 | |
| debian/ffmpeg | 7:4.3.7-0+deb11u1 7:4.3.8-0+deb11u1 7:5.1.6-0+deb12u1 7:7.1-3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15733
- https://github.com/FFmpeg/FFmpeg/commit/8df6884832ec413cf032dfaa45c23b1c7876670c
- https://security.gentoo.org/glsa/202003-65
- https://www.debian.org/security/2020/dsa-4722
- https://usn.ubuntu.com/4431-1/
- https://lists.debian.org/debian-lts-announce/2021/01/msg00026.html
- https://launchpad.net/bugs/cve/CVE-2019-17539
- https://security-tracker.debian.org/tracker/CVE-2019-17539
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17539
- https://nvd.nist.gov/vuln/detail/CVE-2019-17539
- https://ubuntu.com/security/CVE-2019-17539
Frequently Asked Questions
What is CVE-2019-17539?
CVE-2019-17539 is a vulnerability in FFmpeg before 4.2 that allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.
What is the severity of CVE-2019-17539?
CVE-2019-17539 has a severity rating of 9.8 (Critical).
Which software versions are affected by CVE-2019-17539?
The affected software versions include FFmpeg versions up to 4.0.5, 4.1.5, and 3.4.7, as well as Debian Linux 9.0, Debian Linux 10.0, and Canonical Ubuntu Linux 16.04, 18.04, and 20.04.
How do I fix CVE-2019-17539?
To fix CVE-2019-17539, update to FFmpeg version 4.2 or higher and apply the available patches provided by your operating system vendor.
Where can I find more information about CVE-2019-17539?
You can find more information about CVE-2019-17539 on the CVE Mitre website, the Chromium OSS-Fuzz bug tracker, and the Ubuntu Security Notices website.
- agent/type
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/remedy
- agent/severity
- agent/weakness
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- collector/nvd-cve
- source/NVD
- agent/last-modified-date
- agent/softwarecombine
- agent/trending
- vendor/ffmpeg
- canonical/ffmpeg ffmpeg
- version/ffmpeg ffmpeg/4.0
- version/ffmpeg ffmpeg/4.1
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/16.04
- version/canonical ubuntu linux/18.04
- version/canonical ubuntu linux/20.04
- package-manager/debian