CVE-2022-3964

2022-11-1308:15:14

CWE-119

[email protected]

web.nvd.nist.gov

cve-2022-3964

ffmpeg

quicktime rpza video encoder

vulnerability

out-of-bounds read

remote attack

patch

nvd

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

0.002 Low

EPSS

Percentile

57.4%

JSON

A vulnerability classified as problematic has been found in ffmpeg. This affects an unknown part of the file libavcodec/rpzaenc.c of the component QuickTime RPZA Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. It is possible to initiate the attack remotely. The name of the patch is 92f9b28ed84a77138105475beba16c146bdaf984. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213543.

Affected configurations

NVD

Node

ffmpegffmpegRange4.4–4.4.4

ffmpegffmpegRange5.0–5.0.3

ffmpegffmpegRange5.1–5.1.3

CPENameOperatorVersion
ffmpeg:ffmpegffmpeglt4.4.4
ffmpeg:ffmpegffmpeglt5.0.3
ffmpeg:ffmpegffmpeglt5.1.3

CPE	Name	Operator	Version
ffmpeg:ffmpeg	ffmpeg	lt	4.4.4
ffmpeg:ffmpeg	ffmpeg	lt	5.0.3
ffmpeg:ffmpeg	ffmpeg	lt	5.1.3

CNA Affected

[
  {
    "vendor": "unspecified",
    "product": "ffmpeg",
    "versions": [
      {
        "version": "n/a",
        "status": "affected"
      }
    ]
  }
]