Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web servers to execute arbitrary code via a negative chunk size in an HTTP response.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg | Oct 1, 2024 | Feb 9, 2017 |
| Debian | — | Upgrade ffmpeg | Feb 20, 2019 | Feb 9, 2017 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.8.10Upgrade to FFmpeg version 3.2.2Upgrade to FFmpeg version 3.1.6Upgrade to FFmpeg version 3.0.5 | Sep 29, 2017 | Feb 9, 2017 |
| Suse | — | Upgrade libavfilter6Upgrade libpostproc54Upgrade ffmpegUpgrade libavutil55Upgrade libavfilter5Upgrade libavdevice56Upgrade libswscale-develUpgrade libavutil54Upgrade ffmpeg-develUpgrade libpostproc53Upgrade libswresample-develUpgrade libavcodec57Upgrade libavutil-develUpgrade libswscale3Upgrade libavformat-develUpgrade libpostproc-develUpgrade libavformat56Upgrade libavresample-develUpgrade libavcodec56Upgrade libavresample2Upgrade libswresample1Upgrade libavcodec-develUpgrade libavresample3Upgrade libswresample2Upgrade libavfilter-develUpgrade libavdevice-develUpgrade libavformat57Upgrade libavdevice57Upgrade libswscale4 | Apr 11, 2017 | Feb 9, 2017 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Feb 9, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub