Paul Mehta

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions prior to 2.4.6 **Description** The issue is related to an integer underflow in the mov read default function in libavformat/mov.c, which allows remote attackers to obtain sensitive information from heap and/or stack memory via a crafted MP4 file. **Recommendations** For versions prior to 2.4.6, update to version 2.4.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 54.0.2840.98 for Mac Google Chrome versions prior to 54.0.2840.99 for Windows Google Chrome versions prior to 54.0.2840.100 for Linux Google Chrome versions prior to 55.0.2883.84 for Android **Description** The issue is caused by an off by one error resulting in an allocation of zero size in FFmpeg, which can lead to heap corruption. A remote attacker can potentially exploit this issue via a crafted video file, causing a denial of service. **Recommendations** For Google Chrome versions prior to 54.0.2840.98 for Mac, update to version 54.0.2840.98 or later. For Google Chrome versions prior to 54.0.2840.99 for Windows, update to version 54.0.2840.99 or later. For Google Chrome versions prior to 54.0.2840.100 for Linux, update to version 54.0.2840.100 or later. For Google Chrome versions prior to 55.0.2883.84 for Android, update to version 55.0.2883.84 or later.