CVE Vulnerabilities

CVE-2018-1999012

Loop with Unreachable Exit Condition ('Infinite Loop')

Published: Jul 23, 2018 | Modified: Nov 21, 2024
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.x
7.1 HIGH
AV:N/AC:M/Au:N/C:N/I:N/A:C
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later.

Weakness

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Software

Name Vendor Start Version End Version
Ffmpeg Ffmpeg * 4.0.1 (including)
Chromium-browser Ubuntu bionic *
Chromium-browser Ubuntu cosmic *
Chromium-browser Ubuntu devel *
Chromium-browser Ubuntu disco *
Chromium-browser Ubuntu eoan *
Chromium-browser Ubuntu esm-apps/noble *
Chromium-browser Ubuntu focal *
Chromium-browser Ubuntu groovy *
Chromium-browser Ubuntu hirsute *
Chromium-browser Ubuntu impish *
Chromium-browser Ubuntu jammy *
Chromium-browser Ubuntu kinetic *
Chromium-browser Ubuntu lunar *
Chromium-browser Ubuntu mantic *
Chromium-browser Ubuntu noble *
Chromium-browser Ubuntu oracular *
Chromium-browser Ubuntu trusty *
Chromium-browser Ubuntu upstream *
Chromium-browser Ubuntu xenial *
Ffmpeg Ubuntu cosmic *
Ffmpeg Ubuntu xenial *
Gst-libav1.0 Ubuntu bionic *
Gst-libav1.0 Ubuntu cosmic *
Gst-libav1.0 Ubuntu disco *
Gst-libav1.0 Ubuntu eoan *
Gst-libav1.0 Ubuntu groovy *
Gst-libav1.0 Ubuntu hirsute *
Gst-libav1.0 Ubuntu impish *
Gst-libav1.0 Ubuntu kinetic *
Gst-libav1.0 Ubuntu lunar *
Gst-libav1.0 Ubuntu mantic *
Gst-libav1.0 Ubuntu trusty *
Gst-libav1.0 Ubuntu xenial *
Kino Ubuntu bionic *
Kino Ubuntu cosmic *
Kino Ubuntu disco *
Kino Ubuntu eoan *
Kino Ubuntu groovy *
Kino Ubuntu hirsute *
Kino Ubuntu impish *
Kino Ubuntu trusty *
Kino Ubuntu xenial *
Libav Ubuntu trusty *
Libav Ubuntu trusty/esm *
Oxide-qt Ubuntu esm-infra/xenial *
Oxide-qt Ubuntu trusty *
Oxide-qt Ubuntu xenial *
Qtwebengine-opensource-src Ubuntu bionic *
Qtwebengine-opensource-src Ubuntu cosmic *
Qtwebengine-opensource-src Ubuntu disco *
Qtwebengine-opensource-src Ubuntu eoan *
Qtwebengine-opensource-src Ubuntu groovy *
Qtwebengine-opensource-src Ubuntu hirsute *
Qtwebengine-opensource-src Ubuntu impish *
Qtwebengine-opensource-src Ubuntu kinetic *
Qtwebengine-opensource-src Ubuntu lunar *
Qtwebengine-opensource-src Ubuntu mantic *

References