PT-2017-2399 · FFmpeg · Ffmpeg

Published 2017-01-23 · Updated 2018-01-01 · CVE-2016-6164

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 2.8.8 FFmpeg versions 3.0.x prior to 3.0.3 FFmpeg versions 3.1.x prior to 3.1.1

Description The issue is caused by an integer overflow in the mov build index function, which can be exploited by remote attackers via vectors involving sample size, potentially allowing them to have an unspecified impact.

Recommendations For FFmpeg versions prior to 2.8.8, update to version 2.8.8 or later. For FFmpeg versions 3.0.x prior to 3.0.3, update to version 3.0.3 or later. For FFmpeg versions 3.1.x prior to 3.1.1, update to version 3.1.1 or later.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2017-01602

CVE-2016-6164

MGASA-2018-0008

Affected Products

Ffmpeg

References · 17

• https://osv.dev/vulnerability/MGASA-2018-0008 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-6164 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6164 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2016-6164 · Vendor Advisory
• https://ffmpeg.org/security.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0008.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-6164 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6164 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01602 · Security Note
• https://cve.org/CVERecord?id=CVE-2016-6164 · Security Note
• https://osv.dev/vulnerability/CVE-2016-6164 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-6164 · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=20757 · Note
• https://security.alpinelinux.org/vuln/CVE-2016-6164 · Note
• http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8a3221cc67a516dfc1700bdae3566ec52c7ee823 · Note