3 issues skipped by the security teams:
- CVE-2019-13390: In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.
- CVE-2019-17542: FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c.
- CVE-2019-17539: In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/f/ffmpeg.png){kind=link}