PT-2016-5349 · Libav+1 · Libav+1

Published 2016-06-14 · Updated 2024-06-15 · CVE-2016-3062

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Libav versions prior to 11.7 FFmpeg versions prior to 0.11

Description The issue allows remote attackers to cause a denial of service or execute arbitrary code via the entries value in a dref box in an MP4 file. This is due to a problem in the mov read dref function in libavformat/mov.c.

Recommendations For Libav versions prior to 11.7, update to version 11.7 or later. For FFmpeg versions prior to 0.11, update to version 0.11 or later.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2016-3062

DLA-515-1

DSA-3603-1

OPENSUSE-SU-2024:10926-1

Affected Products

Ffmpeg

Libav

References · 33

• https://github.com/FFmpeg/FFmpeg/commit/689e59b7ffed34eba6159dcc78e87133862e3746 · Patch
• https://osv.dev/vulnerability/DSA-3603-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3062 · Security Note
• https://bugzilla.libav.org/show_bug.cgi?id=929 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-3062 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-3062 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-3062 · Security Note
• https://security-tracker.debian.org/tracker/source-package/libav · Vendor Advisory
• http://debian.org/security/2016/dsa-3603 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-3062 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-3062 · Vendor Advisory
• https://security.gentoo.org/glsa/201705-08 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-3062 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-3062 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10926-1 · Vendor Advisory