PT-2017-9212 · Libav · Libav

Agostino Sarubbo · Published 2017-02-15 · Updated 2017-02-17 · CVE-2016-7499

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Libav version 11.7

Description The issue allows remote attackers to cause a denial of service, resulting in a divide-by-zero error and application crash, via a crafted mp3 file. This is due to a problem in the sbr make f master function.

Recommendations For Libav version 11.7, consider avoiding the use of the sbr make f master function until a patch is available. As a temporary workaround, restrict the processing of crafted mp3 files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

CVE-2016-7499

Affected Products

Libav

References · 10

• https://blogs.gentoo.org/ago/2016/09/21/libav-divide-by-zero-in-sbr_make_f_master-aacsbr-c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-7499 · Security Note
• https://osv.dev/vulnerability/CVE-2016-7499 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-7499 · Security Note
• https://ubuntu.com/security/CVE-2016-7499 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-7499 · Vendor Advisory
• https://git.libav.org/?p=libav.git%3Ba=blobdiff%3Bf=libavcodec/aacsbr.c%3Bh=7d156e525b40b197c38db17acf16730845b91e56%3Bhp=dbfb1677813ce6c531e4362d0be7ccf9fdfdd28e%3Bhb=a50a5ff29ec5a8243499769e2bb9b5509ce9fd52%3Bhpb=f55e3ff5891daf3d538b4d9176371960200d68fa · Note
• http://securityfocus.com/bid/93102 · Note
• http://openwall.com/lists/oss-security/2016/09/21/9 · Note
• http://openwall.com/lists/oss-security/2016/09/21/7 · Note