PT-2016-7776 · FFmpeg+1 · Ffmpeg+1

Lian Yihan · Published 2016-12-23 · Updated 2017-09-16 · CVE-2016-9561

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 3.2.1

Description The issue allows remote attackers to cause a denial of service by allocating huge memory via a crafted MOV file. This is due to a problem in the che configure function in libavcodec/aacdec template.c.

Recommendations For versions prior to 3.2.1, update to version 3.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to crafted MOV files to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2016-9561

OPENSUSE-SU-2017:1531-1

OPENSUSE-SU-2017:1532-1

OPENSUSE-SU-2017_2502-1

Affected Products

Ffmpeg

Suse

References · 80

• https://bdu.fstec.ru/vul/2017-02092 · Security Note
• https://bdu.fstec.ru/vul/2017-02298 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9561 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01539 · Security Note
• https://ubuntu.com/security/CVE-2016-9561 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9561 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02093 · Security Note
• https://bdu.fstec.ru/vul/2017-02091 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2017:1531-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01540 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-9561 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02085 · Security Note
• https://bdu.fstec.ru/vul/2024-09065 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9561 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01550 · Security Note