Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg | Oct 1, 2024 | Feb 9, 2017 |
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Feb 9, 2017 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.8.10Upgrade to FFmpeg version 3.2.2Upgrade to FFmpeg version 2.4.14Upgrade to FFmpeg version 3.0.5Upgrade to FFmpeg version 3.1.6 | Sep 29, 2017 | Feb 9, 2017 |
| Suse | — | Upgrade libavformat-develUpgrade libavfilter6Upgrade libswscale4Upgrade libavdevice56Upgrade libavfilter-develUpgrade libswresample2Upgrade libavdevice-develUpgrade libswresample1Upgrade libavresample2Upgrade libavfilter5Upgrade libpostproc-develUpgrade libavresample-develUpgrade libavcodec-develUpgrade libavresample3Upgrade libavutil-develUpgrade libavformat57Upgrade libavutil54Upgrade libavformat56Upgrade ffmpeg2-develUpgrade libswscale-develUpgrade libswscale3Upgrade libswresample-develUpgrade libavutil55Upgrade libavcodec57Upgrade libpostproc53Upgrade libpostproc54Upgrade ffmpegUpgrade libavdevice57Upgrade libavcodec56 | May 2, 2017 | Feb 9, 2017 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Feb 9, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub