PT-2017-2340 · FFmpeg+1 · Ffmpeg+1
Published
2017-02-09
·
Updated
2018-01-01
·
CVE-2016-10192
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
FFmpeg versions prior to 2.8.10
FFmpeg versions 3.0.x prior to 3.0.5
FFmpeg versions 3.1.x prior to 3.1.6
FFmpeg versions 3.2.x prior to 3.2.2
Description
The issue is caused by a heap-based buffer overflow in the ffserver.c component of FFmpeg, which can be exploited by remote attackers to execute arbitrary code. This is due to the failure to check the chunk size, allowing attackers to leverage this oversight and gain unauthorized access.
Recommendations
For FFmpeg versions prior to 2.8.10, update to version 2.8.10 or later.
For FFmpeg versions 3.0.x prior to 3.0.5, update to version 3.0.5 or later.
For FFmpeg versions 3.1.x prior to 3.1.6, update to version 3.1.6 or later.
For FFmpeg versions 3.2.x prior to 3.2.2, update to version 3.2.2 or later.
As a temporary workaround, consider restricting access to the ffserver.c component until a patch is applied.
Fix
RCE
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ffmpeg
Suse