The decode_ihdr_chunk function in libavcodec/pngdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via an IDAT before an IHDR in a PNG file.

The remote host is affected by the vulnerability described in GLSA-201603-06 (FFmpeg: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FFmpeg.  Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code or cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Please reference CVE/URL list for details

The Mageia project reports :

Avidemux is built with a bundled set of FFmpeg libraries. The bundled FFmpeg version has been updated from 1.2.10 to 1.2.12 to fix these security issues and other bugs fixed upstream in FFmpeg.

ID	Name	Product	Family	Severity
89899	GLSA-201603-06 : FFmpeg: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
83940	FreeBSD : ffmpeg -- multiple vulnerabilities (65b14d39-d01f-419c-b0b8-5df60b929973)	Nessus	FreeBSD Local Security Checks	high
83939	FreeBSD : avidemux26 -- multiple vulnerabilities in bundled FFmpeg (022255be-0895-11e5-a242-5404a68ad561)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2014-9317

high

Tenable Plugins

critical

high

high