CVE-2022-3341

2023-01-1215:15:10

CWE-476

fedora

web.nvd.nist.gov

cve-2022-3341

ffmpeg

null pointer

dereference issue

libavformat

nutdec.c

application crash

nvd

security vulnerability

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

42.9%

JSON

A null pointer dereference issue was discovered in ‘FFmpeg’ in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.

Affected configurations

Nvd

Node

ffmpegffmpegRange<5.1

VendorProductVersionCPE
ffmpegffmpeg*cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ffmpeg	ffmpeg	*	cpe:2.3:a:ffmpeg:ffmpeg::::::::

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "FFmpeg",
    "versions": [
      {
        "version": "Fixed-in ffmpeg 5.1",
        "status": "affected"
      }
    ]
  }
]