Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before 3.0.3 and 3.1.x before 3.1.1 allows remote attackers to have unspecified impact via vectors involving sample size.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before
    3.0.3 and 3.1.x before 3.1.1 allows remote attackers to have unspecified impact via vectors involving
    sample size. (CVE-2016-6164)

  - An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to
    54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for
    Android allowed a remote attacker to potentially exploit heap corruption via a crafted video file.
    (CVE-2016-5199)

  - The zlib_refill function in libavformat/swfdec.c in FFmpeg before 3.1.3 allows remote attackers to cause
    an infinite loop denial of service via a crafted SWF file. (CVE-2016-6881)

  - The avi_read_nikon function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to infinite loop
    when it decodes an AVI file that has a crafted 'nctg' structure. (CVE-2016-7122)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before
    3.0.3 and 3.1.x before 3.1.1 allows remote attackers to have unspecified impact via vectors involving
    sample size. (CVE-2016-6164)

  - The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote
    attackers to cause a denial of service (out-of-bounds array read access) via crafted JPEG 2000 data.
    (CVE-2016-2213)

  - libswscale/swscale_unscaled.c in FFmpeg before 2.8.6 does not validate certain height values, which allows
    remote attackers to cause a denial of service (out-of-bounds array read access) or possibly have
    unspecified other impact via a crafted .cine file, related to the bayer_to_rgb24_wrapper and
    bayer_to_yv12_wrapper functions. (CVE-2016-2328)

  - libavcodec/tiff.c in FFmpeg before 2.8.6 does not properly validate RowsPerStrip values and YCbCr
    chrominance subsampling factors, which allows remote attackers to cause a denial of service (out-of-bounds
    array access) or possibly have unspecified other impact via a crafted TIFF file, related to the
    tiff_decode_tag and decode_frame functions. (CVE-2016-2329)

  - libavcodec/gif.c in FFmpeg before 2.8.6 does not properly calculate a buffer size, which allows remote
    attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other
    impact via a crafted .tga file, related to the gif_image_write_image, gif_encode_init, and
    gif_encode_close functions. (CVE-2016-2330)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before
    3.0.3 and 3.1.x before 3.1.1 allows remote attackers to have unspecified impact via vectors involving
    sample size. (CVE-2016-6164)

  - The zlib_refill function in libavformat/swfdec.c in FFmpeg before 3.1.3 allows remote attackers to cause
    an infinite loop denial of service via a crafted SWF file. (CVE-2016-6881)

  - The avi_read_nikon function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to infinite loop
    when it decodes an AVI file that has a crafted 'nctg' structure. (CVE-2016-7122)

  - The ff_log2_16bit_c function in libavutil/intmath.h in FFmpeg before 3.1.4 is vulnerable to reading out-
    of-bounds memory when it decodes a malformed AIFF file. (CVE-2016-7450)

ID	Name	Product	Family	Severity
404290	Alpine: multiple ffmpeg packages: security update to 3.0.7-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404290	Alpine: multiple ffmpeg packages: security update to 3.0.7-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
404289	Alpine: multiple ffmpeg packages: security update to 2.8.11-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404289	Alpine: multiple ffmpeg packages: security update to 2.8.11-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
400952	Alpine: ffmpeg2.8: security update to 2.8.7-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
400952	Alpine: ffmpeg2.8: security update to 2.8.7-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical

Detections

Analytics

CVE-2016-6164

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical