Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg | Oct 1, 2024 | Feb 9, 2017 |
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Feb 9, 2017 |
| Ffmpeg | — | Upgrade to FFmpeg version 3.1.6Upgrade to FFmpeg version 3.0.5Upgrade to FFmpeg version 2.4.14Upgrade to FFmpeg version 3.2.2Upgrade to FFmpeg version 2.8.10 | Sep 29, 2017 | Feb 9, 2017 |
| Suse | — | Upgrade libswscale3Upgrade libswresample-develUpgrade libpostproc54Upgrade libswscale-develUpgrade libavutil55Upgrade libavdevice57Upgrade libavcodec57Upgrade libpostproc53Upgrade libavcodec56Upgrade ffmpegUpgrade libavcodec-develUpgrade libavutil54Upgrade libavformat-develUpgrade libavdevice56Upgrade libavfilter-develUpgrade libavfilter5Upgrade libavresample-develUpgrade libpostproc-develUpgrade libswresample2Upgrade libswscale4Upgrade libavresample3Upgrade libavutil-develUpgrade libavformat57Upgrade libavfilter6Upgrade libavdevice-develUpgrade ffmpeg2-develUpgrade libavformat56Upgrade libavresample2Upgrade libswresample1 | May 2, 2017 | Feb 9, 2017 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Feb 9, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub