The che_configure function in libavcodec/aacdec_template.c in FFmpeg before 3.2.1 allows remote attackers to cause a denial of service (allocation of huge memory, and being killed by the OS) via a crafted MOV file.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Dec 23, 2016 |
| Ffmpeg | — | Upgrade to FFmpeg version 3.2.1 | Sep 29, 2017 | Dec 23, 2016 |
| Suse | — | Upgrade libswscale-develUpgrade libswscale4Upgrade libavdevice57Upgrade libavresample-develUpgrade libavdevice-develUpgrade libavformat-develUpgrade libavformat56Upgrade libavdevice56Upgrade libswscale3Upgrade libavcodec-develUpgrade libavutil55Upgrade libavutil54Upgrade libswresample2Upgrade libavfilter-develUpgrade libavcodec56Upgrade libpostproc54Upgrade ffmpegUpgrade libavresample2Upgrade libavutil-develUpgrade libavresample3Upgrade libavfilter6Upgrade libavfilter5Upgrade libpostproc-develUpgrade libavcodec57Upgrade libavformat57Upgrade ffmpeg2-develUpgrade libswresample1Upgrade libswresample-develUpgrade libpostproc53 | May 29, 2017 | Dec 23, 2016 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Dec 23, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub