The mov_read_dref function in libavformat/mov.c in Libav before 11.7 and FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via the entries value in a dref box in an MP4 file.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libavUpgrade ffmpeg | Jun 15, 2016 | Jun 14, 2016 |
| Ffmpeg | — | Upgrade to FFmpeg version 0.11 | Sep 29, 2017 | Jun 16, 2016 |
| Gentoo Linux | — | Upgrade media-video/libav. | Oct 30, 2017 | Jun 16, 2016 |
| Suse | — | Upgrade libavresample-libav-develUpgrade libswscale-libav3Upgrade libavdevice-libav55-debuginfoUpgrade libav-debugsourceUpgrade libavfilter-libav5Upgrade libavcodec-libav56-debuginfoUpgrade libav-toolsUpgrade libavutil-libav-develUpgrade libavformat-libav-develUpgrade libavformat-libav56Upgrade libavcodec-libav-develUpgrade libavresample-libav2Upgrade libavdevice-libav55Upgrade libavformat-libav56-debuginfoUpgrade libavfilter-libav5-debuginfoUpgrade libav-tools-debuginfoUpgrade libavdevice-libav-develUpgrade libswscale-libav3-debuginfoUpgrade libswscale-libav-develUpgrade libavutil-libav54-debuginfoUpgrade libavutil-libav54Upgrade libavcodec-libav56Upgrade libavresample-libav2-debuginfoUpgrade libavfilter-libav-devel | Jul 26, 2016 | Jun 16, 2016 |
| Ubuntu | — | Upgrade libav (Ubuntu Pro) | Nov 19, 2024 | Jun 16, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub