{"id":"CVE-2018-1999010","details":"FFmpeg before commit cced03dd667a5df6df8fd40d8de0bff477ee02e8 contains multiple out of array access vulnerabilities in the mms protocol that can result in attackers accessing out of bound data. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in cced03dd667a5df6df8fd40d8de0bff477ee02e8 and later.","modified":"2026-08-18T09:40:56.463553Z","published":"2018-07-23T15:29:00.297Z","related":["SUSE-SU-2018:2305-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"}]},"references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/104896"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html"},{"type":"FIX","url":"https://github.com/FFmpeg/FFmpeg/commit/cced03dd667a5df6df8fd40d8de0bff477ee02e8"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.ffmpeg.org/ffmpeg.git","events":[{"introduced":"0"},{"fixed":"89355585366b16238244decae40fbe0cc7ae3e40"}],"database_specific":{"cpe":"cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.4.3"}],"source":"CPE_RANGE"}}],"versions":["n3.4.2","n3.4.1","n3.4","n3.4-dev","n3.3-dev","n3.2-dev","n3.1-dev","n2.9-dev","n2.8-dev","n2.7-dev","n2.6-dev","n2.5-dev","n2.4-dev","n2.3-dev","n2.2-dev","n2.0","n2.1-dev","n1.3-dev","n1.2-dev","n1.1-dev","n0.12-dev","n0.11-dev","n0.8","N"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-1999010.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/ffmpeg/ffmpeg","events":[{"introduced":"0"},{"fixed":"89355585366b16238244decae40fbe0cc7ae3e40"},{"fixed":"cced03dd667a5df6df8fd40d8de0bff477ee02e8"}],"database_specific":{"cpe":"cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.4.3"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["n4.1-dev","n3.4.2","n3.4.1","n3.4","n3.5-dev","n3.4-dev","n3.3-dev","n3.2-dev","n3.1-dev","n2.9-dev","n2.8-dev","n2.7-dev","n2.6-dev","n2.5-dev","n2.4-dev","n2.3-dev","n2.2-dev","n2.0","n2.1-dev","n1.3-dev","n1.2-dev","n1.1-dev","n0.12-dev","n0.11-dev","n0.8","N"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-1999010.json","vanir_signatures_modified":"2026-08-18T09:40:56Z","vanir_signatures":[{"source":"https://github.com/ffmpeg/ffmpeg/commit/cced03dd667a5df6df8fd40d8de0bff477ee02e8","target":{"file":"libavformat/mms.c"},"deprecated":false,"digest":{"line_hashes":["78202195712770235845065918008995714155","25754445282885046612092702458519684185","277023884937850835968330685448119124084","278019681951011323163437926332972927971","250647003674814466267960988228712149874","10814176852304190284463812927232303010","189833846312113163077900897036612244375","19635734148578544078999212882141600268","335001464036977556978172061875076137859","83089085845436435126876043989897867700","289597708622081956339038641287220750052","58087555352726034300245463660698804744","238178062944026379763027691125163598947","222188485564963357637829767566231347864","213228672373721048432388768205835982387","327139887196078928637424783087343747395","235445644620037478916316203513574216654","49274175430772575505439545061306277492","133972656849788101831967806197120893869","173019152454466486649455865797028269205","230702447792541292929342687107060858423","134120086518410833275263912502801714221"],"threshold":0.9},"id":"CVE-2018-1999010-652843dd","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/cced03dd667a5df6df8fd40d8de0bff477ee02e8","target":{"file":"libavformat/mms.c","function":"ff_mms_asf_header_parser"},"deprecated":false,"digest":{"function_hash":"149159414930309841586555126726355166271","length":2951},"id":"CVE-2018-1999010-77877fcc","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}