Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web servers to execute arbitrary code via a negative chunk size in an HTTP response.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg | Oct 1, 2024 | Feb 9, 2017 |
| Debian | — | Upgrade ffmpeg | Feb 20, 2019 | Feb 9, 2017 |
| Ffmpeg | — | Upgrade to FFmpeg version 3.0.5Upgrade to FFmpeg version 2.8.10Upgrade to FFmpeg version 3.2.2Upgrade to FFmpeg version 3.1.6 | Sep 29, 2017 | Feb 9, 2017 |
| Suse | — | Upgrade libavcodec57Upgrade libavutil55Upgrade libavfilter5Upgrade libswscale-develUpgrade libpostproc54Upgrade libavutil-develUpgrade libpostproc53Upgrade libavfilter6Upgrade libavutil54Upgrade ffmpegUpgrade libavdevice56Upgrade ffmpeg-develUpgrade libswresample-develUpgrade libavfilter-develUpgrade libavformat-develUpgrade libavdevice57Upgrade libpostproc-develUpgrade libswresample2Upgrade libswresample1Upgrade libavresample2Upgrade libavresample3Upgrade libavresample-develUpgrade libavcodec-develUpgrade libswscale3Upgrade libswscale4Upgrade libavformat56Upgrade libavdevice-develUpgrade libavformat57Upgrade libavcodec56 | Apr 11, 2017 | Feb 9, 2017 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Feb 9, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub