The mov_read_dref function in libavformat/mov.c in Libav before 11.7 and FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via the entries value in a dref box in an MP4 file.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libavUpgrade ffmpeg | Jun 15, 2016 | Jun 14, 2016 |
| Ffmpeg | — | Upgrade to FFmpeg version 0.11 | Sep 29, 2017 | Jun 16, 2016 |
| Gentoo Linux | — | Upgrade media-video/libav. | Oct 30, 2017 | Jun 16, 2016 |
| Suse | — | Upgrade libavdevice-libav55-debuginfoUpgrade libav-toolsUpgrade libavutil-libav-develUpgrade libavfilter-libav5Upgrade libavresample-libav-develUpgrade libavresample-libav2Upgrade libavformat-libav-develUpgrade libavfilter-libav5-debuginfoUpgrade libav-debugsourceUpgrade libavdevice-libav55Upgrade libavformat-libav56Upgrade libavformat-libav56-debuginfoUpgrade libswscale-libav3Upgrade libavcodec-libav56-debuginfoUpgrade libavcodec-libav-develUpgrade libavcodec-libav56Upgrade libswscale-libav3-debuginfoUpgrade libavfilter-libav-develUpgrade libswscale-libav-develUpgrade libavdevice-libav-develUpgrade libavutil-libav54Upgrade libavutil-libav54-debuginfoUpgrade libavresample-libav2-debuginfoUpgrade libav-tools-debuginfo | Jul 26, 2016 | Jun 16, 2016 |
| Ubuntu | — | Upgrade libav (Ubuntu Pro) | Nov 19, 2024 | Jun 16, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub