PT-2016-7776 · FFmpeg+1 · Ffmpeg+1

Lian Yihan · Publicado 2016-12-23 · Atualizado 2017-09-16 · CVE-2016-9561

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 3.2.1

Description The issue allows remote attackers to cause a denial of service by allocating huge memory via a crafted MOV file. This is due to a problem in the che configure function in libavcodec/aacdec template.c.

Recommendations For versions prior to 3.2.1, update to version 3.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to crafted MOV files to minimize the risk of exploitation.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2016-9561

OPENSUSE-SU-2017:1531-1

OPENSUSE-SU-2017:1532-1

OPENSUSE-SU-2017_2502-1

Produtos afetados

Ffmpeg

Suse

Referências · 80

• https://github.com/FFmpeg/FFmpeg/commit/30581c51e72a7a7ea1572c1c6039f6e4c590a55c · Nota
• https://bdu.fstec.ru/vul/2017-02092 · Nota de Segurança
• https://bugzilla.suse.com/1058020 · Nota
• https://bdu.fstec.ru/vul/2017-02298 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9561 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-14054.html · Nota
• https://suse.com/security/cve/CVE-2017-14171.html · Nota
• https://suse.com/security/cve/CVE-2017-7866 · Nota
• https://bdu.fstec.ru/vul/2017-01539 · Nota de Segurança
• https://bugzilla.suse.com/1058018 · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/5KP24SRISSSDJLJ5BH6QGAZRN6R5R6JO · Nota
• https://bugzilla.suse.com/1046211 · Nota
• https://secfree.com/article-396.html · Nota
• https://ubuntu.com/security/CVE-2016-9561 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-7865 · Nota