The che_configure function in libavcodec/aacdec_template.c in FFmpeg before 3.2.1 allows remote attackers to cause a denial of service (allocation of huge memory, and being killed by the OS) via a crafted MOV file.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Dec 23, 2016 |
| Ffmpeg | — | Upgrade to FFmpeg version 3.2.1 | Sep 29, 2017 | Dec 23, 2016 |
| Suse | — | Upgrade libavformat57Upgrade libpostproc53Upgrade libavfilter5Upgrade libpostproc-develUpgrade libavutil-develUpgrade libavresample3Upgrade libavcodec57Upgrade libavfilter6Upgrade ffmpeg2-develUpgrade libswresample-develUpgrade libswresample1Upgrade libswresample2Upgrade libavformat56Upgrade libavresample2Upgrade libavcodec-develUpgrade libavdevice-develUpgrade libswscale3Upgrade libavfilter-develUpgrade libavdevice56Upgrade libavutil54Upgrade libavutil55Upgrade libswscale4Upgrade libavresample-develUpgrade libavdevice57Upgrade libavformat-develUpgrade libpostproc54Upgrade libavcodec56Upgrade ffmpegUpgrade libswscale-devel | May 29, 2017 | Dec 23, 2016 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Dec 23, 2016 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub