PT-2017-19328 · FFmpeg · Ffmpeg

Published 2017-06-28 · Updated 2017-07-03 · CVE-2017-9995

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg versions 3.3 through 3.3.1 (excluding 3.3.1)

Description The issue is related to improper validation of height and width data in a crafted file, which can cause a denial of service (heap-based buffer overflow and application crash) or possibly have other unspecified impacts.

Recommendations For FFmpeg versions 3.3 through 3.3.1 (excluding 3.3.1), update to version 3.3.1 or later to resolve the issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-9995

Affected Products

Ffmpeg

References · 7

• https://github.com/FFmpeg/FFmpeg/commit/7ac5067146613997bb38442cb022d7f41321a706 · Patch
• https://github.com/FFmpeg/FFmpeg/commit/2171dfae8c065878a2e130390eb78cf2947a5b69 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-9995 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9995 · Vendor Advisory
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1519 · Note
• http://securityfocus.com/bid/99320 · Note
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1478 · Note